@probelabs/visor 0.1.146 → 0.1.147-ee

package/dist/index.js

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
-process.env.VISOR_VERSION = '0.1.146';
-process.env.PROBE_VERSION = '0.6.0-rc260';
-process.env.VISOR_COMMIT_SHA = 'd2ab098a3650d6798ede2306a8ed4b5fdb6214fb';
-process.env.VISOR_COMMIT_SHORT = 'd2ab098';
+process.env.VISOR_VERSION = '0.1.147';
+process.env.PROBE_VERSION = '0.6.0-rc262';
+process.env.VISOR_COMMIT_SHA = '986bd9df126dcf4c0564d12701994e4bad407897';
+process.env.VISOR_COMMIT_SHORT = '986bd9d';
 /******/ (() => { // webpackBootstrap
 /******/ 	var __webpack_modules__ = ({
 
@@ -160001,6 +160001,7 @@ ${'='.repeat(60)}
             if (!systemPrompt && schema !== 'code-review') {
                 systemPrompt = 'You are general assistant, follow user instructions.';
             }
+            log(`🔧 AIReviewService config: allowEdit=${this.config.allowEdit}, allowBash=${this.config.allowBash}, promptType=${this.config.promptType}`);
             const options = {
                 sessionId: sessionId,
                 // Prefer config promptType, then env override, else fallback to code-review when schema is set
@@ -160011,7 +160012,7 @@ ${'='.repeat(60)}
                         : schema === 'code-review'
                             ? 'code-review-template'
                             : undefined,
-                allowEdit: false, // We don't want the agent to modify files
+                allowEdit: false, // Default: don't allow file modifications
                 debug: this.config.debug || false,
                 // Use systemPrompt (native in rc168+) with fallback to customPrompt for backward compat
                 systemPrompt: systemPrompt || this.config.systemPrompt || this.config.customPrompt,
@@ -160059,6 +160060,7 @@ ${'='.repeat(60)}
                 options.fallback = this.config.fallback;
             }
             // Enable Edit and Create tools if configured
+            // Enable Edit and Create tools if configured
             if (this.config.allowEdit !== undefined) {
                 options.allowEdit = this.config.allowEdit;
             }
@@ -160134,6 +160136,7 @@ ${'='.repeat(60)}
             if (this.config.model) {
                 options.model = this.config.model;
             }
+            log(`🔧 ProbeAgent options: allowEdit=${options.allowEdit}, enableBash=${options.enableBash}, promptType=${options.promptType}`);
             const agent = new probe_1.ProbeAgent(options);
             // Initialize agent to enable CLI fallback detection (claude-code/codex)
             // This must be called before agent.answer() for auto-fallback to work.
@@ -161190,7 +161193,7 @@ async function handleDumpPolicyInput(checkId, argv) {
     let PolicyInputBuilder;
     try {
         // @ts-ignore — enterprise/ may not exist in OSS builds (caught at runtime)
-        const mod = await Promise.resolve().then(() => __importStar(__nccwpck_require__(71370)));
+        const mod = await Promise.resolve().then(() => __importStar(__nccwpck_require__(17117)));
         PolicyInputBuilder = mod.PolicyInputBuilder;
     }
     catch {
@@ -161380,6 +161383,15 @@ async function handleTestCommand(argv) {
     // Respect --debug flag if present, or VISOR_DEBUG from environment
     const debugFlag = hasFlag('--debug') || process.env.VISOR_DEBUG === 'true';
     (0, logger_1.configureLoggerFromCli)({ output: 'table', debug: debugFlag, verbose: false, quiet: false });
+    // Initialize telemetry for test runs (auto-enabled in --no-mocks mode)
+    const telemetryEnabled = noMocks || process.env.VISOR_TELEMETRY_ENABLED === 'true';
+    if (telemetryEnabled) {
+        await (0, opentelemetry_1.initTelemetry)({
+            enabled: true,
+            sink: process.env.VISOR_TELEMETRY_SINK || 'file',
+            file: { dir: process.env.VISOR_TRACE_DIR },
+        });
+    }
     console.log('🧪 Visor Test Runner');
     try {
         const { discoverAndPrint, validateTestsOnly, VisorTestRunner, discoverSuites, runSuites } = await Promise.resolve().then(() => __importStar(__nccwpck_require__(41585)));
@@ -161658,9 +161670,21 @@ async function handleTestCommand(argv) {
             }
         }
         catch { }
+        if (telemetryEnabled) {
+            try {
+                await (0, opentelemetry_1.shutdownTelemetry)();
+            }
+            catch { }
+        }
         process.exit(failures > 0 ? 1 : 0);
     }
     catch (err) {
+        if (telemetryEnabled) {
+            try {
+                await (0, opentelemetry_1.shutdownTelemetry)();
+            }
+            catch { }
+        }
         console.error('❌ test: ' + (err instanceof Error ? err.message : String(err)));
         process.exit(1);
     }
@@ -161905,6 +161929,11 @@ async function main() {
                     if (authResult) {
                         // Inject token + git credentials into process.env for child processes
                         (0, github_auth_1.injectGitHubCredentials)(authResult.token);
+                        // Mark as fresh so long-running modes (Slack, scheduler) don't regenerate immediately
+                        if (authResult.authType === 'github-app') {
+                            const { markTokenFresh } = await Promise.resolve().then(() => __importStar(__nccwpck_require__(11347)));
+                            markTokenFresh();
+                        }
                         // Set Octokit on execution context for in-process API calls
                         executionContext.octokit = authResult.octokit;
                         logger_1.logger.info(`🔑 GitHub auth: ${authResult.authType}`);
@@ -164046,17 +164075,11 @@ class ConfigManager {
         const { WorkflowRegistry } = await Promise.resolve().then(() => __importStar(__nccwpck_require__(82824)));
         const registry = WorkflowRegistry.getInstance();
         // Import workflow files
+        // Use override: true so config reloads pick up changes to workflow definitions
         for (const source of config.imports) {
-            const results = await registry.import(source, { basePath, validate: true });
+            const results = await registry.import(source, { basePath, validate: true, override: true });
             for (const result of results) {
                 if (!result.valid && result.errors) {
-                    // Check if error is just "already exists" - skip silently
-                    // This allows multiple workflows to import the same dependency
-                    const isAlreadyExists = result.errors.every(e => e.message.includes('already exists'));
-                    if (isAlreadyExists) {
-                        logger_1.logger.debug(`Workflow from '${source}' already imported, skipping`);
-                        continue;
-                    }
                     const errors = result.errors.map(e => `  ${e.path}: ${e.message}`).join('\n');
                     throw new Error(`Failed to import workflow from '${source}':\n${errors}`);
                 }
@@ -167012,6 +167035,1690 @@ class DependencyResolver {
 exports.DependencyResolver = DependencyResolver;
 
 
+/***/ }),
+
+/***/ 50069:
+/***/ (function(__unused_webpack_module, exports, __nccwpck_require__) {
+
+"use strict";
+
+/**
+ * Copyright (c) ProbeLabs. All rights reserved.
+ * Licensed under the Elastic License 2.0; you may not use this file except
+ * in compliance with the Elastic License 2.0.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.LicenseValidator = void 0;
+const crypto = __importStar(__nccwpck_require__(76982));
+const fs = __importStar(__nccwpck_require__(79896));
+const path = __importStar(__nccwpck_require__(16928));
+class LicenseValidator {
+    /** Ed25519 public key for license verification (PEM format). */
+    static PUBLIC_KEY = '-----BEGIN PUBLIC KEY-----\n' +
+        'MCowBQYDK2VwAyEAI/Zd08EFmgIdrDm/HXd0l3/5GBt7R1PrdvhdmEXhJlU=\n' +
+        '-----END PUBLIC KEY-----\n';
+    cache = null;
+    static CACHE_TTL = 5 * 60 * 1000; // 5 minutes
+    static GRACE_PERIOD = 72 * 3600 * 1000; // 72 hours after expiry
+    /**
+     * Load and validate license from environment or file.
+     *
+     * Resolution order:
+     * 1. VISOR_LICENSE env var (JWT string)
+     * 2. VISOR_LICENSE_FILE env var (path to file)
+     * 3. .visor-license in project root (cwd)
+     * 4. .visor-license in ~/.config/visor/
+     */
+    async loadAndValidate() {
+        // Return cached result if still fresh
+        if (this.cache && Date.now() - this.cache.validatedAt < LicenseValidator.CACHE_TTL) {
+            return this.cache.payload;
+        }
+        const token = this.resolveToken();
+        if (!token)
+            return null;
+        const payload = this.verifyAndDecode(token);
+        if (!payload)
+            return null;
+        this.cache = { payload, validatedAt: Date.now() };
+        return payload;
+    }
+    /** Check if a specific feature is licensed */
+    hasFeature(feature) {
+        if (!this.cache)
+            return false;
+        return this.cache.payload.features.includes(feature);
+    }
+    /** Check if license is valid (with grace period) */
+    isValid() {
+        if (!this.cache)
+            return false;
+        const now = Date.now();
+        const expiryMs = this.cache.payload.exp * 1000;
+        return now < expiryMs + LicenseValidator.GRACE_PERIOD;
+    }
+    /** Check if the license is within its grace period (expired but still valid) */
+    isInGracePeriod() {
+        if (!this.cache)
+            return false;
+        const now = Date.now();
+        const expiryMs = this.cache.payload.exp * 1000;
+        return now >= expiryMs && now < expiryMs + LicenseValidator.GRACE_PERIOD;
+    }
+    resolveToken() {
+        // 1. Direct env var
+        if (process.env.VISOR_LICENSE) {
+            return process.env.VISOR_LICENSE.trim();
+        }
+        // 2. File path from env (validate against path traversal)
+        if (process.env.VISOR_LICENSE_FILE) {
+            // path.resolve() produces an absolute path with all '..' segments resolved,
+            // so a separate resolved.includes('..') check is unnecessary.
+            const resolved = path.resolve(process.env.VISOR_LICENSE_FILE);
+            const home = process.env.HOME || process.env.USERPROFILE || '';
+            const allowedPrefixes = [path.normalize(process.cwd())];
+            if (home)
+                allowedPrefixes.push(path.normalize(path.join(home, '.config', 'visor')));
+            // Resolve symlinks so an attacker cannot create a symlink inside an
+            // allowed prefix that points to an arbitrary file outside it.
+            let realPath;
+            try {
+                realPath = fs.realpathSync(resolved);
+            }
+            catch {
+                return null; // File doesn't exist or isn't accessible
+            }
+            const isSafe = allowedPrefixes.some(prefix => realPath === prefix || realPath.startsWith(prefix + path.sep));
+            if (!isSafe)
+                return null;
+            return this.readFile(realPath);
+        }
+        // 3. .visor-license in cwd
+        const cwdPath = path.join(process.cwd(), '.visor-license');
+        const cwdToken = this.readFile(cwdPath);
+        if (cwdToken)
+            return cwdToken;
+        // 4. ~/.config/visor/.visor-license
+        const home = process.env.HOME || process.env.USERPROFILE || '';
+        if (home) {
+            const configPath = path.join(home, '.config', 'visor', '.visor-license');
+            const configToken = this.readFile(configPath);
+            if (configToken)
+                return configToken;
+        }
+        return null;
+    }
+    readFile(filePath) {
+        try {
+            return fs.readFileSync(filePath, 'utf-8').trim();
+        }
+        catch {
+            return null;
+        }
+    }
+    verifyAndDecode(token) {
+        try {
+            const parts = token.split('.');
+            if (parts.length !== 3)
+                return null;
+            const [headerB64, payloadB64, signatureB64] = parts;
+            // Decode header to verify algorithm
+            const header = JSON.parse(Buffer.from(headerB64, 'base64url').toString());
+            if (header.alg !== 'EdDSA')
+                return null;
+            // Verify signature
+            const data = `${headerB64}.${payloadB64}`;
+            const signature = Buffer.from(signatureB64, 'base64url');
+            const publicKey = crypto.createPublicKey(LicenseValidator.PUBLIC_KEY);
+            // Validate that the loaded public key is actually Ed25519 (OID 1.3.101.112).
+            // This prevents algorithm-confusion attacks if the embedded key were ever
+            // swapped to a different type.
+            if (publicKey.asymmetricKeyType !== 'ed25519') {
+                return null;
+            }
+            // Ed25519 verification: algorithm must be null because EdDSA performs its
+            // own internal hashing (SHA-512) — passing a digest algorithm here would
+            // cause Node.js to throw. The key type is validated above.
+            const isValid = crypto.verify(null, Buffer.from(data), publicKey, signature);
+            if (!isValid)
+                return null;
+            // Decode payload
+            const payload = JSON.parse(Buffer.from(payloadB64, 'base64url').toString());
+            // Validate required fields
+            if (!payload.org ||
+                !Array.isArray(payload.features) ||
+                typeof payload.exp !== 'number' ||
+                typeof payload.iat !== 'number' ||
+                !payload.sub) {
+                return null;
+            }
+            // Check expiry (with grace period)
+            const now = Date.now();
+            const expiryMs = payload.exp * 1000;
+            if (now >= expiryMs + LicenseValidator.GRACE_PERIOD) {
+                return null;
+            }
+            return payload;
+        }
+        catch {
+            return null;
+        }
+    }
+}
+exports.LicenseValidator = LicenseValidator;
+
+
+/***/ }),
+
+/***/ 87068:
+/***/ (function(__unused_webpack_module, exports, __nccwpck_require__) {
+
+"use strict";
+
+/**
+ * Copyright (c) ProbeLabs. All rights reserved.
+ * Licensed under the Elastic License 2.0; you may not use this file except
+ * in compliance with the Elastic License 2.0.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.loadEnterprisePolicyEngine = loadEnterprisePolicyEngine;
+exports.loadEnterpriseStoreBackend = loadEnterpriseStoreBackend;
+const default_engine_1 = __nccwpck_require__(93866);
+/**
+ * Load the enterprise policy engine if licensed, otherwise return the default no-op engine.
+ *
+ * This is the sole import boundary between OSS and enterprise code. Core code
+ * must only import from this module (via dynamic `await import()`), never from
+ * individual enterprise submodules.
+ */
+async function loadEnterprisePolicyEngine(config) {
+    try {
+        const { LicenseValidator } = await Promise.resolve().then(() => __importStar(__nccwpck_require__(50069)));
+        const validator = new LicenseValidator();
+        const license = await validator.loadAndValidate();
+        if (!license || !validator.hasFeature('policy')) {
+            return new default_engine_1.DefaultPolicyEngine();
+        }
+        if (validator.isInGracePeriod()) {
+            // eslint-disable-next-line no-console
+            console.warn('[visor:enterprise] License has expired but is within the 72-hour grace period. ' +
+                'Please renew your license.');
+        }
+        const { OpaPolicyEngine } = await Promise.resolve().then(() => __importStar(__nccwpck_require__(39530)));
+        const engine = new OpaPolicyEngine(config);
+        await engine.initialize(config);
+        return engine;
+    }
+    catch (err) {
+        // Enterprise code not available or initialization failed
+        const msg = err instanceof Error ? err.message : String(err);
+        try {
+            const { logger } = __nccwpck_require__(86999);
+            logger.warn(`[PolicyEngine] Enterprise policy init failed, falling back to default: ${msg}`);
+        }
+        catch {
+            // silent
+        }
+        return new default_engine_1.DefaultPolicyEngine();
+    }
+}
+/**
+ * Load the enterprise schedule store backend if licensed.
+ *
+ * @param driver Database driver ('postgresql', 'mysql', or 'mssql')
+ * @param storageConfig Storage configuration with connection details
+ * @param haConfig Optional HA configuration
+ * @throws Error if enterprise license is not available or missing 'scheduler-sql' feature
+ */
+async function loadEnterpriseStoreBackend(driver, storageConfig, haConfig) {
+    const { LicenseValidator } = await Promise.resolve().then(() => __importStar(__nccwpck_require__(50069)));
+    const validator = new LicenseValidator();
+    const license = await validator.loadAndValidate();
+    if (!license || !validator.hasFeature('scheduler-sql')) {
+        throw new Error(`The ${driver} schedule storage driver requires a Visor Enterprise license ` +
+            `with the 'scheduler-sql' feature. Please upgrade or use driver: 'sqlite' (default).`);
+    }
+    if (validator.isInGracePeriod()) {
+        // eslint-disable-next-line no-console
+        console.warn('[visor:enterprise] License has expired but is within the 72-hour grace period. ' +
+            'Please renew your license.');
+    }
+    const { KnexStoreBackend } = await Promise.resolve().then(() => __importStar(__nccwpck_require__(63737)));
+    return new KnexStoreBackend(driver, storageConfig, haConfig);
+}
+
+
+/***/ }),
+
+/***/ 628:
+/***/ (function(__unused_webpack_module, exports, __nccwpck_require__) {
+
+"use strict";
+
+/**
+ * Copyright (c) ProbeLabs. All rights reserved.
+ * Licensed under the Elastic License 2.0; you may not use this file except
+ * in compliance with the Elastic License 2.0.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.OpaCompiler = void 0;
+const fs = __importStar(__nccwpck_require__(79896));
+const path = __importStar(__nccwpck_require__(16928));
+const os = __importStar(__nccwpck_require__(70857));
+const crypto = __importStar(__nccwpck_require__(76982));
+const child_process_1 = __nccwpck_require__(35317);
+/**
+ * OPA Rego Compiler - compiles .rego policy files to WASM bundles using the `opa` CLI.
+ *
+ * Handles:
+ * - Resolving input paths to WASM bytes (direct .wasm, directory with policy.wasm, or .rego files)
+ * - Compiling .rego files to WASM via `opa build`
+ * - Caching compiled bundles based on content hashes
+ * - Extracting policy.wasm from OPA tar.gz bundles
+ *
+ * Requires:
+ * - `opa` CLI on PATH (only when auto-compiling .rego files)
+ */
+class OpaCompiler {
+    static CACHE_DIR = path.join(os.tmpdir(), 'visor-opa-cache');
+    /**
+     * Resolve the input paths to WASM bytes.
+     *
+     * Strategy:
+     * 1. If any path is a .wasm file, read it directly
+     * 2. If a directory contains policy.wasm, read it
+     * 3. Otherwise, collect all .rego files and auto-compile via `opa build`
+     */
+    async resolveWasmBytes(paths) {
+        // Collect .rego files and check for existing .wasm
+        const regoFiles = [];
+        for (const p of paths) {
+            const resolved = path.resolve(p);
+            // Reject paths containing '..' after resolution (path traversal)
+            if (path.normalize(resolved).includes('..')) {
+                throw new Error(`Policy path contains traversal sequences: ${p}`);
+            }
+            // Direct .wasm file
+            if (resolved.endsWith('.wasm') && fs.existsSync(resolved)) {
+                return fs.readFileSync(resolved);
+            }
+            if (!fs.existsSync(resolved))
+                continue;
+            const stat = fs.statSync(resolved);
+            if (stat.isDirectory()) {
+                // Check for pre-compiled policy.wasm in directory
+                const wasmCandidate = path.join(resolved, 'policy.wasm');
+                if (fs.existsSync(wasmCandidate)) {
+                    return fs.readFileSync(wasmCandidate);
+                }
+                // Collect all .rego files from directory
+                const files = fs.readdirSync(resolved);
+                for (const f of files) {
+                    if (f.endsWith('.rego')) {
+                        regoFiles.push(path.join(resolved, f));
+                    }
+                }
+            }
+            else if (resolved.endsWith('.rego')) {
+                regoFiles.push(resolved);
+            }
+        }
+        if (regoFiles.length === 0) {
+            throw new Error(`OPA WASM evaluator: no .wasm bundle or .rego files found in: ${paths.join(', ')}`);
+        }
+        // Auto-compile .rego -> .wasm
+        return this.compileRego(regoFiles);
+    }
+    /**
+     * Auto-compile .rego files to a WASM bundle using the `opa` CLI.
+     *
+     * Caches the compiled bundle based on a content hash of all input .rego files
+     * so subsequent runs skip compilation if policies haven't changed.
+     */
+    compileRego(regoFiles) {
+        // Check that `opa` CLI is available
+        try {
+            (0, child_process_1.execFileSync)('opa', ['version'], { stdio: 'pipe' });
+        }
+        catch {
+            throw new Error('OPA CLI (`opa`) not found on PATH. Install it from https://www.openpolicyagent.org/docs/latest/#running-opa\n' +
+                'Or pre-compile your .rego files: opa build -t wasm -e visor -o bundle.tar.gz ' +
+                regoFiles.join(' '));
+        }
+        // Compute content hash for cache key
+        const hash = crypto.createHash('sha256');
+        for (const f of regoFiles.sort()) {
+            hash.update(fs.readFileSync(f));
+            hash.update(f); // include filename for disambiguation
+        }
+        const cacheKey = hash.digest('hex').slice(0, 16);
+        const cacheDir = OpaCompiler.CACHE_DIR;
+        const cachedWasm = path.join(cacheDir, `${cacheKey}.wasm`);
+        // Return cached bundle if still valid
+        if (fs.existsSync(cachedWasm)) {
+            return fs.readFileSync(cachedWasm);
+        }
+        // Compile to WASM via opa build
+        fs.mkdirSync(cacheDir, { recursive: true });
+        const bundleTar = path.join(cacheDir, `${cacheKey}-bundle.tar.gz`);
+        try {
+            const args = [
+                'build',
+                '-t',
+                'wasm',
+                '-e',
+                'visor', // entrypoint: the visor package tree
+                '-o',
+                bundleTar,
+                ...regoFiles,
+            ];
+            (0, child_process_1.execFileSync)('opa', args, {
+                stdio: 'pipe',
+                timeout: 30000,
+            });
+        }
+        catch (err) {
+            const stderr = err?.stderr?.toString() || '';
+            throw new Error(`Failed to compile .rego files to WASM:\n${stderr}\n` +
+                'Ensure your .rego files are valid and the `opa` CLI is installed.');
+        }
+        // Extract policy.wasm from the tar.gz bundle
+        // OPA bundles are tar.gz with /policy.wasm inside
+        try {
+            (0, child_process_1.execFileSync)('tar', ['-xzf', bundleTar, '-C', cacheDir, '/policy.wasm'], {
+                stdio: 'pipe',
+            });
+            const extractedWasm = path.join(cacheDir, 'policy.wasm');
+            if (fs.existsSync(extractedWasm)) {
+                // Move to cache-key named file
+                fs.renameSync(extractedWasm, cachedWasm);
+            }
+        }
+        catch {
+            // Some tar implementations don't like leading /
+            try {
+                (0, child_process_1.execFileSync)('tar', ['-xzf', bundleTar, '-C', cacheDir, 'policy.wasm'], {
+                    stdio: 'pipe',
+                });
+                const extractedWasm = path.join(cacheDir, 'policy.wasm');
+                if (fs.existsSync(extractedWasm)) {
+                    fs.renameSync(extractedWasm, cachedWasm);
+                }
+            }
+            catch (err2) {
+                throw new Error(`Failed to extract policy.wasm from OPA bundle: ${err2?.message || err2}`);
+            }
+        }
+        // Clean up tar
+        try {
+            fs.unlinkSync(bundleTar);
+        }
+        catch { }
+        if (!fs.existsSync(cachedWasm)) {
+            throw new Error('OPA build succeeded but policy.wasm was not found in the bundle');
+        }
+        return fs.readFileSync(cachedWasm);
+    }
+}
+exports.OpaCompiler = OpaCompiler;
+
+
+/***/ }),
+
+/***/ 44693:
+/***/ ((__unused_webpack_module, exports) => {
+
+"use strict";
+
+/**
+ * Copyright (c) ProbeLabs. All rights reserved.
+ * Licensed under the Elastic License 2.0; you may not use this file except
+ * in compliance with the Elastic License 2.0.
+ */
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.OpaHttpEvaluator = void 0;
+/**
+ * OPA HTTP Evaluator - evaluates policies via an external OPA server's REST API.
+ *
+ * Uses the built-in `fetch` API (Node 18+), so no extra dependencies are needed.
+ */
+class OpaHttpEvaluator {
+    baseUrl;
+    timeout;
+    constructor(baseUrl, timeout = 5000) {
+        // Validate URL format and protocol
+        let parsed;
+        try {
+            parsed = new URL(baseUrl);
+        }
+        catch {
+            throw new Error(`OPA HTTP evaluator: invalid URL: ${baseUrl}`);
+        }
+        if (!['http:', 'https:'].includes(parsed.protocol)) {
+            throw new Error(`OPA HTTP evaluator: url must use http:// or https:// protocol, got: ${baseUrl}`);
+        }
+        // Block cloud metadata, loopback, link-local, and private network addresses
+        const hostname = parsed.hostname;
+        if (this.isBlockedHostname(hostname)) {
+            throw new Error(`OPA HTTP evaluator: url must not point to internal, loopback, or private network addresses`);
+        }
+        // Normalize: strip trailing slash
+        this.baseUrl = baseUrl.replace(/\/+$/, '');
+        this.timeout = timeout;
+    }
+    /**
+     * Check if a hostname is blocked due to SSRF concerns.
+     *
+     * Blocks:
+     * - Loopback addresses (127.x.x.x, localhost, 0.0.0.0, ::1)
+     * - Link-local addresses (169.254.x.x)
+     * - Private networks (10.x.x.x, 172.16-31.x.x, 192.168.x.x)
+     * - IPv6 unique local addresses (fd00::/8)
+     * - Cloud metadata services (*.internal)
+     */
+    isBlockedHostname(hostname) {
+        if (!hostname)
+            return true; // block empty hostnames
+        // Normalize hostname: lowercase and remove brackets for IPv6
+        const normalized = hostname.toLowerCase().replace(/^\[|\]$/g, '');
+        // Block .internal domains (cloud metadata services)
+        if (normalized === 'metadata.google.internal' || normalized.endsWith('.internal')) {
+            return true;
+        }
+        // Block localhost variants
+        if (normalized === 'localhost' || normalized === 'localhost.localdomain') {
+            return true;
+        }
+        // Block IPv6 loopback
+        if (normalized === '::1' || normalized === '0:0:0:0:0:0:0:1') {
+            return true;
+        }
+        // Check IPv4 patterns
+        const ipv4Pattern = /^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/;
+        const ipv4Match = normalized.match(ipv4Pattern);
+        if (ipv4Match) {
+            const octets = ipv4Match.slice(1, 5).map(Number);
+            // Validate octets are in range [0, 255]
+            if (octets.some(octet => octet > 255)) {
+                return false;
+            }
+            const [a, b] = octets;
+            // Block loopback: 127.0.0.0/8
+            if (a === 127) {
+                return true;
+            }
+            // Block 0.0.0.0/8 (this host)
+            if (a === 0) {
+                return true;
+            }
+            // Block link-local: 169.254.0.0/16
+            if (a === 169 && b === 254) {
+                return true;
+            }
+            // Block private networks
+            // 10.0.0.0/8
+            if (a === 10) {
+                return true;
+            }
+            // 172.16.0.0/12 (172.16.x.x through 172.31.x.x)
+            if (a === 172 && b >= 16 && b <= 31) {
+                return true;
+            }
+            // 192.168.0.0/16
+            if (a === 192 && b === 168) {
+                return true;
+            }
+        }
+        // Check IPv6 patterns
+        // Block unique local addresses: fd00::/8
+        if (normalized.startsWith('fd') || normalized.startsWith('fc')) {
+            return true;
+        }
+        // Block link-local: fe80::/10
+        if (normalized.startsWith('fe80:')) {
+            return true;
+        }
+        return false;
+    }
+    /**
+     * Evaluate a policy rule against an input document via OPA REST API.
+     *
+     * @param input - The input document to evaluate
+     * @param rulePath - OPA rule path (e.g., 'visor/check/execute')
+     * @returns The result object from OPA, or undefined on error
+     */
+    async evaluate(input, rulePath) {
+        // OPA Data API: POST /v1/data/<path>
+        const encodedPath = rulePath
+            .split('/')
+            .map(s => encodeURIComponent(s))
+            .join('/');
+        const url = `${this.baseUrl}/v1/data/${encodedPath}`;
+        const controller = new AbortController();
+        const timer = setTimeout(() => controller.abort(), this.timeout);
+        try {
+            const response = await fetch(url, {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/json' },
+                body: JSON.stringify({ input }),
+                signal: controller.signal,
+            });
+            if (!response.ok) {
+                throw new Error(`OPA HTTP ${response.status}: ${response.statusText}`);
+            }
+            let body;
+            try {
+                body = await response.json();
+            }
+            catch (jsonErr) {
+                throw new Error(`OPA HTTP evaluator: failed to parse JSON response: ${jsonErr instanceof Error ? jsonErr.message : String(jsonErr)}`);
+            }
+            // OPA returns { result: { ... } }
+            return body?.result;
+        }
+        finally {
+            clearTimeout(timer);
+        }
+    }
+    async shutdown() {
+        // No persistent connections to close
+    }
+}
+exports.OpaHttpEvaluator = OpaHttpEvaluator;
+
+
+/***/ }),
+
+/***/ 39530:
+/***/ ((__unused_webpack_module, exports, __nccwpck_require__) => {
+
+"use strict";
+
+/**
+ * Copyright (c) ProbeLabs. All rights reserved.
+ * Licensed under the Elastic License 2.0; you may not use this file except
+ * in compliance with the Elastic License 2.0.
+ */
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.OpaPolicyEngine = void 0;
+const opa_wasm_evaluator_1 = __nccwpck_require__(8613);
+const opa_http_evaluator_1 = __nccwpck_require__(44693);
+const policy_input_builder_1 = __nccwpck_require__(17117);
+/**
+ * Enterprise OPA Policy Engine.
+ *
+ * Wraps both WASM (local) and HTTP (remote) OPA evaluators behind the
+ * OSS PolicyEngine interface. All OPA input building and role resolution
+ * is handled internally — the OSS call sites pass only plain types.
+ */
+class OpaPolicyEngine {
+    evaluator = null;
+    fallback;
+    timeout;
+    config;
+    inputBuilder = null;
+    logger = null;
+    constructor(config) {
+        this.config = config;
+        this.fallback = config.fallback || 'deny';
+        this.timeout = config.timeout || 5000;
+    }
+    async initialize(config) {
+        // Resolve logger once at initialization
+        try {
+            this.logger = (__nccwpck_require__(86999).logger);
+        }
+        catch {
+            // logger not available in this context
+        }
+        // Build actor/repo context from environment (available at engine init time)
+        const actor = {
+            authorAssociation: process.env.VISOR_AUTHOR_ASSOCIATION,
+            login: process.env.VISOR_AUTHOR_LOGIN || process.env.GITHUB_ACTOR,
+            isLocalMode: !process.env.GITHUB_ACTIONS,
+        };
+        const repo = {
+            owner: process.env.GITHUB_REPOSITORY_OWNER,
+            name: process.env.GITHUB_REPOSITORY?.split('/')[1],
+            branch: process.env.GITHUB_HEAD_REF,
+            baseBranch: process.env.GITHUB_BASE_REF,
+            event: process.env.GITHUB_EVENT_NAME,
+        };
+        const prNum = process.env.GITHUB_PR_NUMBER
+            ? parseInt(process.env.GITHUB_PR_NUMBER, 10)
+            : undefined;
+        const pullRequest = {
+            number: prNum !== undefined && Number.isFinite(prNum) ? prNum : undefined,
+        };
+        this.inputBuilder = new policy_input_builder_1.PolicyInputBuilder(config, actor, repo, pullRequest);
+        if (config.engine === 'local') {
+            if (!config.rules) {
+                throw new Error('OPA local mode requires `policy.rules` path to .wasm or .rego files');
+            }
+            const wasm = new opa_wasm_evaluator_1.OpaWasmEvaluator();
+            await wasm.initialize(config.rules);
+            if (config.data) {
+                wasm.loadData(config.data);
+            }
+            this.evaluator = wasm;
+        }
+        else if (config.engine === 'remote') {
+            if (!config.url) {
+                throw new Error('OPA remote mode requires `policy.url` pointing to OPA server');
+            }
+            this.evaluator = new opa_http_evaluator_1.OpaHttpEvaluator(config.url, this.timeout);
+        }
+        else {
+            this.evaluator = null;
+        }
+    }
+    /**
+     * Update actor/repo/PR context (e.g., after PR info becomes available).
+     * Called by the enterprise loader when engine context is enriched.
+     */
+    setActorContext(actor, repo, pullRequest) {
+        this.inputBuilder = new policy_input_builder_1.PolicyInputBuilder(this.config, actor, repo, pullRequest);
+    }
+    async evaluateCheckExecution(checkId, checkConfig) {
+        if (!this.evaluator || !this.inputBuilder)
+            return { allowed: true };
+        const cfg = checkConfig && typeof checkConfig === 'object'
+            ? checkConfig
+            : {};
+        const policyOverride = cfg.policy;
+        const input = this.inputBuilder.forCheckExecution({
+            id: checkId,
+            type: cfg.type || 'ai',
+            group: cfg.group,
+            tags: cfg.tags,
+            criticality: cfg.criticality,
+            sandbox: cfg.sandbox,
+            policy: policyOverride,
+        });
+        return this.doEvaluate(input, this.resolveRulePath('check.execute', policyOverride?.rule));
+    }
+    async evaluateToolInvocation(serverName, methodName, transport) {
+        if (!this.evaluator || !this.inputBuilder)
+            return { allowed: true };
+        const input = this.inputBuilder.forToolInvocation(serverName, methodName, transport);
+        return this.doEvaluate(input, 'visor/tool/invoke');
+    }
+    async evaluateCapabilities(checkId, capabilities) {
+        if (!this.evaluator || !this.inputBuilder)
+            return { allowed: true };
+        const input = this.inputBuilder.forCapabilityResolve(checkId, capabilities);
+        return this.doEvaluate(input, 'visor/capability/resolve');
+    }
+    async shutdown() {
+        if (this.evaluator && 'shutdown' in this.evaluator) {
+            await this.evaluator.shutdown();
+        }
+        this.evaluator = null;
+        this.inputBuilder = null;
+    }
+    resolveRulePath(defaultScope, override) {
+        if (override) {
+            return override.startsWith('visor/') ? override : `visor/${override}`;
+        }
+        return `visor/${defaultScope.replace(/\./g, '/')}`;
+    }
+    async doEvaluate(input, rulePath) {
+        try {
+            this.logger?.debug(`[PolicyEngine] Evaluating ${rulePath}`, JSON.stringify(input));
+            let timer;
+            const timeoutPromise = new Promise((_resolve, reject) => {
+                timer = setTimeout(() => reject(new Error('policy evaluation timeout')), this.timeout);
+            });
+            try {
+                const result = await Promise.race([this.rawEvaluate(input, rulePath), timeoutPromise]);
+                const decision = this.parseDecision(result);
+                // In warn mode, override denied decisions to allowed but flag as warn
+                if (!decision.allowed && this.fallback === 'warn') {
+                    decision.allowed = true;
+                    decision.warn = true;
+                    decision.reason = `audit: ${decision.reason || 'policy denied'}`;
+                }
+                this.logger?.debug(`[PolicyEngine] Decision for ${rulePath}: allowed=${decision.allowed}, warn=${decision.warn || false}, reason=${decision.reason || 'none'}`);
+                return decision;
+            }
+            finally {
+                if (timer)
+                    clearTimeout(timer);
+            }
+        }
+        catch (err) {
+            const msg = err instanceof Error ? err.message : String(err);
+            this.logger?.warn(`[PolicyEngine] Evaluation failed for ${rulePath}: ${msg}`);
+            return {
+                allowed: this.fallback === 'allow' || this.fallback === 'warn',
+                warn: this.fallback === 'warn' ? true : undefined,
+                reason: `policy evaluation failed, fallback=${this.fallback}`,
+            };
+        }
+    }
+    async rawEvaluate(input, rulePath) {
+        if (this.evaluator instanceof opa_wasm_evaluator_1.OpaWasmEvaluator) {
+            const result = await this.evaluator.evaluate(input);
+            // WASM compiled with `-e visor` entrypoint returns the full visor package tree.
+            // Navigate to the specific rule subtree using rulePath segments.
+            // e.g., 'visor/check/execute' → result.check.execute
+            return this.navigateWasmResult(result, rulePath);
+        }
+        return this.evaluator.evaluate(input, rulePath);
+    }
+    /**
+     * Navigate nested OPA WASM result tree to reach the specific rule's output.
+     * The WASM entrypoint `-e visor` means the result root IS the visor package,
+     * so we strip the `visor/` prefix and walk the remaining segments.
+     */
+    navigateWasmResult(result, rulePath) {
+        if (!result || typeof result !== 'object')
+            return result;
+        // Strip the 'visor/' prefix (matches our compilation entrypoint)
+        const segments = rulePath.replace(/^visor\//, '').split('/');
+        let current = result;
+        for (const seg of segments) {
+            if (current && typeof current === 'object' && seg in current) {
+                current = current[seg];
+            }
+            else {
+                return undefined; // path not found in result tree
+            }
+        }
+        return current;
+    }
+    parseDecision(result) {
+        if (result === undefined || result === null) {
+            return {
+                allowed: this.fallback === 'allow' || this.fallback === 'warn',
+                warn: this.fallback === 'warn' ? true : undefined,
+                reason: this.fallback === 'warn' ? 'audit: no policy result' : 'no policy result',
+            };
+        }
+        const allowed = result.allowed !== false;
+        const decision = {
+            allowed,
+            reason: result.reason,
+        };
+        if (result.capabilities) {
+            decision.capabilities = result.capabilities;
+        }
+        return decision;
+    }
+}
+exports.OpaPolicyEngine = OpaPolicyEngine;
+
+
+/***/ }),
+
+/***/ 8613:
+/***/ (function(__unused_webpack_module, exports, __nccwpck_require__) {
+
+"use strict";
+
+/**
+ * Copyright (c) ProbeLabs. All rights reserved.
+ * Licensed under the Elastic License 2.0; you may not use this file except
+ * in compliance with the Elastic License 2.0.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.OpaWasmEvaluator = void 0;
+const fs = __importStar(__nccwpck_require__(79896));
+const path = __importStar(__nccwpck_require__(16928));
+const opa_compiler_1 = __nccwpck_require__(628);
+/**
+ * OPA WASM Evaluator - loads and evaluates OPA policies locally.
+ *
+ * Supports three input formats:
+ * 1. Pre-compiled `.wasm` bundle — loaded directly (fastest startup)
+ * 2. `.rego` files or directory — auto-compiled to WASM via `opa build` CLI
+ * 3. Directory with `policy.wasm` inside — loaded directly
+ *
+ * Compilation and caching of .rego files is delegated to {@link OpaCompiler}.
+ *
+ * Requires:
+ * - `@open-policy-agent/opa-wasm` npm package (optional dep)
+ * - `opa` CLI on PATH (only when auto-compiling .rego files)
+ */
+class OpaWasmEvaluator {
+    policy = null;
+    dataDocument = {};
+    compiler = new opa_compiler_1.OpaCompiler();
+    async initialize(rulesPath) {
+        const paths = Array.isArray(rulesPath) ? rulesPath : [rulesPath];
+        const wasmBytes = await this.compiler.resolveWasmBytes(paths);
+        try {
+            // Use createRequire to load the optional dep at runtime without ncc bundling it.
+            // `new Function('id', 'return require(id)')` fails in ncc bundles because
+            // `require` is not in the `new Function` scope. `createRequire` works correctly
+            // because it creates a real Node.js require rooted at the given path.
+            // eslint-disable-next-line @typescript-eslint/no-var-requires
+            const { createRequire } = __nccwpck_require__(73339);
+            const runtimeRequire = createRequire(__filename);
+            const opaWasm = runtimeRequire('@open-policy-agent/opa-wasm');
+            const loadPolicy = opaWasm.loadPolicy || opaWasm.default?.loadPolicy;
+            if (!loadPolicy) {
+                throw new Error('loadPolicy not found in @open-policy-agent/opa-wasm');
+            }
+            this.policy = await loadPolicy(wasmBytes);
+        }
+        catch (err) {
+            if (err?.code === 'MODULE_NOT_FOUND' || err?.code === 'ERR_MODULE_NOT_FOUND') {
+                throw new Error('OPA WASM evaluator requires @open-policy-agent/opa-wasm. ' +
+                    'Install it with: npm install @open-policy-agent/opa-wasm');
+            }
+            throw err;
+        }
+    }
+    /**
+     * Load external data from a JSON file to use as the OPA data document.
+     * The loaded data will be passed to `policy.setData()` during evaluation,
+     * making it available in Rego via `data.<key>`.
+     */
+    loadData(dataPath) {
+        const resolved = path.resolve(dataPath);
+        if (path.normalize(resolved).includes('..')) {
+            throw new Error(`Data path contains traversal sequences: ${dataPath}`);
+        }
+        if (!fs.existsSync(resolved)) {
+            throw new Error(`OPA data file not found: ${resolved}`);
+        }
+        const stat = fs.statSync(resolved);
+        if (stat.size > 10 * 1024 * 1024) {
+            throw new Error(`OPA data file exceeds 10MB limit: ${resolved} (${stat.size} bytes)`);
+        }
+        const raw = fs.readFileSync(resolved, 'utf-8');
+        try {
+            const parsed = JSON.parse(raw);
+            if (typeof parsed !== 'object' || parsed === null || Array.isArray(parsed)) {
+                throw new Error('OPA data file must contain a JSON object (not an array or primitive)');
+            }
+            this.dataDocument = parsed;
+        }
+        catch (err) {
+            if (err.message.startsWith('OPA data file must')) {
+                throw err;
+            }
+            throw new Error(`Failed to parse OPA data file ${resolved}: ${err.message}`);
+        }
+    }
+    async evaluate(input) {
+        if (!this.policy) {
+            throw new Error('OPA WASM evaluator not initialized');
+        }
+        this.policy.setData(this.dataDocument);
+        const resultSet = this.policy.evaluate(input);
+        if (Array.isArray(resultSet) && resultSet.length > 0) {
+            return resultSet[0].result;
+        }
+        return undefined;
+    }
+    async shutdown() {
+        if (this.policy) {
+            // opa-wasm policy objects may have a close/free method for WASM cleanup
+            if (typeof this.policy.close === 'function') {
+                try {
+                    this.policy.close();
+                }
+                catch { }
+            }
+            else if (typeof this.policy.free === 'function') {
+                try {
+                    this.policy.free();
+                }
+                catch { }
+            }
+        }
+        this.policy = null;
+    }
+}
+exports.OpaWasmEvaluator = OpaWasmEvaluator;
+
+
+/***/ }),
+
+/***/ 17117:
+/***/ ((__unused_webpack_module, exports) => {
+
+"use strict";
+
+/**
+ * Copyright (c) ProbeLabs. All rights reserved.
+ * Licensed under the Elastic License 2.0; you may not use this file except
+ * in compliance with the Elastic License 2.0.
+ */
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.PolicyInputBuilder = void 0;
+/**
+ * Builds OPA-compatible input documents from engine context.
+ *
+ * Resolves actor roles from the `policy.roles` config section by matching
+ * the actor's authorAssociation and login against role definitions.
+ */
+class PolicyInputBuilder {
+    roles;
+    actor;
+    repository;
+    pullRequest;
+    constructor(policyConfig, actor, repository, pullRequest) {
+        this.roles = policyConfig.roles || {};
+        this.actor = actor;
+        this.repository = repository;
+        this.pullRequest = pullRequest;
+    }
+    /** Resolve which roles apply to the current actor. */
+    resolveRoles() {
+        const matched = [];
+        for (const [roleName, roleConfig] of Object.entries(this.roles)) {
+            let identityMatch = false;
+            if (roleConfig.author_association &&
+                this.actor.authorAssociation &&
+                roleConfig.author_association.includes(this.actor.authorAssociation)) {
+                identityMatch = true;
+            }
+            if (!identityMatch &&
+                roleConfig.users &&
+                this.actor.login &&
+                roleConfig.users.includes(this.actor.login)) {
+                identityMatch = true;
+            }
+            // Slack user ID match
+            if (!identityMatch &&
+                roleConfig.slack_users &&
+                this.actor.slack?.userId &&
+                roleConfig.slack_users.includes(this.actor.slack.userId)) {
+                identityMatch = true;
+            }
+            // Email match (case-insensitive)
+            if (!identityMatch && roleConfig.emails && this.actor.slack?.email) {
+                const actorEmail = this.actor.slack.email.toLowerCase();
+                if (roleConfig.emails.some(e => e.toLowerCase() === actorEmail)) {
+                    identityMatch = true;
+                }
+            }
+            // Note: teams-based role resolution requires GitHub API access (read:org scope)
+            // and is not yet implemented. If configured, the role will not match via teams.
+            if (!identityMatch)
+                continue;
+            // slack_channels gate: if set, the role only applies when triggered from one of these channels
+            if (roleConfig.slack_channels && roleConfig.slack_channels.length > 0) {
+                if (!this.actor.slack?.channelId ||
+                    !roleConfig.slack_channels.includes(this.actor.slack.channelId)) {
+                    continue;
+                }
+            }
+            matched.push(roleName);
+        }
+        return matched;
+    }
+    buildActor() {
+        return {
+            authorAssociation: this.actor.authorAssociation,
+            login: this.actor.login,
+            roles: this.resolveRoles(),
+            isLocalMode: this.actor.isLocalMode,
+            ...(this.actor.slack && { slack: this.actor.slack }),
+        };
+    }
+    forCheckExecution(check) {
+        return {
+            scope: 'check.execute',
+            check: {
+                id: check.id,
+                type: check.type,
+                group: check.group,
+                tags: check.tags,
+                criticality: check.criticality,
+                sandbox: check.sandbox,
+                policy: check.policy,
+            },
+            actor: this.buildActor(),
+            repository: this.repository,
+            pullRequest: this.pullRequest,
+        };
+    }
+    forToolInvocation(serverName, methodName, transport) {
+        return {
+            scope: 'tool.invoke',
+            tool: { serverName, methodName, transport },
+            actor: this.buildActor(),
+            repository: this.repository,
+            pullRequest: this.pullRequest,
+        };
+    }
+    forCapabilityResolve(checkId, capabilities) {
+        return {
+            scope: 'capability.resolve',
+            check: { id: checkId, type: 'ai' },
+            capability: capabilities,
+            actor: this.buildActor(),
+            repository: this.repository,
+            pullRequest: this.pullRequest,
+        };
+    }
+}
+exports.PolicyInputBuilder = PolicyInputBuilder;
+
+
+/***/ }),
+
+/***/ 63737:
+/***/ (function(__unused_webpack_module, exports, __nccwpck_require__) {
+
+"use strict";
+
+/**
+ * Copyright (c) ProbeLabs. All rights reserved.
+ * Licensed under the Elastic License 2.0; you may not use this file except
+ * in compliance with the Elastic License 2.0.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.KnexStoreBackend = void 0;
+/**
+ * Knex-backed schedule store for PostgreSQL, MySQL, and MSSQL (Enterprise)
+ *
+ * Uses Knex query builder for database-agnostic SQL. Same schema as SQLite backend
+ * but with real distributed locking via row-level claims (claimed_by/claimed_at/lock_token).
+ */
+const fs = __importStar(__nccwpck_require__(79896));
+const path = __importStar(__nccwpck_require__(16928));
+const uuid_1 = __nccwpck_require__(31914);
+const logger_1 = __nccwpck_require__(86999);
+function toNum(val) {
+    if (val === null || val === undefined)
+        return undefined;
+    return typeof val === 'string' ? parseInt(val, 10) : val;
+}
+function safeJsonParse(value) {
+    if (!value)
+        return undefined;
+    try {
+        return JSON.parse(value);
+    }
+    catch {
+        return undefined;
+    }
+}
+function fromDbRow(row) {
+    return {
+        id: row.id,
+        creatorId: row.creator_id,
+        creatorContext: row.creator_context ?? undefined,
+        creatorName: row.creator_name ?? undefined,
+        timezone: row.timezone,
+        schedule: row.schedule_expr,
+        runAt: toNum(row.run_at),
+        isRecurring: row.is_recurring === true || row.is_recurring === 1,
+        originalExpression: row.original_expression,
+        workflow: row.workflow ?? undefined,
+        workflowInputs: safeJsonParse(row.workflow_inputs),
+        outputContext: safeJsonParse(row.output_context),
+        status: row.status,
+        createdAt: toNum(row.created_at),
+        lastRunAt: toNum(row.last_run_at),
+        nextRunAt: toNum(row.next_run_at),
+        runCount: row.run_count,
+        failureCount: row.failure_count,
+        lastError: row.last_error ?? undefined,
+        previousResponse: row.previous_response ?? undefined,
+    };
+}
+function toInsertRow(schedule) {
+    return {
+        id: schedule.id,
+        creator_id: schedule.creatorId,
+        creator_context: schedule.creatorContext ?? null,
+        creator_name: schedule.creatorName ?? null,
+        timezone: schedule.timezone,
+        schedule_expr: schedule.schedule,
+        run_at: schedule.runAt ?? null,
+        is_recurring: schedule.isRecurring,
+        original_expression: schedule.originalExpression,
+        workflow: schedule.workflow ?? null,
+        workflow_inputs: schedule.workflowInputs ? JSON.stringify(schedule.workflowInputs) : null,
+        output_context: schedule.outputContext ? JSON.stringify(schedule.outputContext) : null,
+        status: schedule.status,
+        created_at: schedule.createdAt,
+        last_run_at: schedule.lastRunAt ?? null,
+        next_run_at: schedule.nextRunAt ?? null,
+        run_count: schedule.runCount,
+        failure_count: schedule.failureCount,
+        last_error: schedule.lastError ?? null,
+        previous_response: schedule.previousResponse ?? null,
+    };
+}
+/**
+ * Enterprise Knex-backed store for PostgreSQL, MySQL, and MSSQL
+ */
+class KnexStoreBackend {
+    knex = null;
+    driver;
+    connection;
+    constructor(driver, storageConfig, _haConfig) {
+        this.driver = driver;
+        this.connection = (storageConfig.connection || {});
+    }
+    async initialize() {
+        // Load knex dynamically
+        const { createRequire } = __nccwpck_require__(73339);
+        const runtimeRequire = createRequire(__filename);
+        let knexFactory;
+        try {
+            knexFactory = runtimeRequire('knex');
+        }
+        catch (err) {
+            const code = err?.code;
+            if (code === 'MODULE_NOT_FOUND' || code === 'ERR_MODULE_NOT_FOUND') {
+                throw new Error('knex is required for PostgreSQL/MySQL/MSSQL schedule storage. ' +
+                    'Install it with: npm install knex');
+            }
+            throw err;
+        }
+        const clientMap = {
+            postgresql: 'pg',
+            mysql: 'mysql2',
+            mssql: 'tedious',
+        };
+        const client = clientMap[this.driver];
+        // Build connection config
+        let connection;
+        if (this.connection.connection_string) {
+            connection = this.connection.connection_string;
+        }
+        else if (this.driver === 'mssql') {
+            connection = this.buildMssqlConnection();
+        }
+        else {
+            connection = this.buildStandardConnection();
+        }
+        this.knex = knexFactory({
+            client,
+            connection,
+            pool: {
+                min: this.connection.pool?.min ?? 0,
+                max: this.connection.pool?.max ?? 10,
+            },
+        });
+        // Run schema migration
+        await this.migrateSchema();
+        logger_1.logger.info(`[KnexStore] Initialized (${this.driver})`);
+    }
+    buildStandardConnection() {
+        return {
+            host: this.connection.host || 'localhost',
+            port: this.connection.port,
+            database: this.connection.database || 'visor',
+            user: this.connection.user,
+            password: this.connection.password,
+            ssl: this.resolveSslConfig(),
+        };
+    }
+    buildMssqlConnection() {
+        const ssl = this.connection.ssl;
+        const sslEnabled = ssl === true || (typeof ssl === 'object' && ssl.enabled !== false);
+        return {
+            server: this.connection.host || 'localhost',
+            port: this.connection.port,
+            database: this.connection.database || 'visor',
+            user: this.connection.user,
+            password: this.connection.password,
+            options: {
+                encrypt: sslEnabled,
+                trustServerCertificate: typeof ssl === 'object' ? ssl.reject_unauthorized === false : !sslEnabled,
+            },
+        };
+    }
+    resolveSslConfig() {
+        const ssl = this.connection.ssl;
+        if (ssl === false || ssl === undefined)
+            return false;
+        if (ssl === true)
+            return { rejectUnauthorized: true };
+        // Object config
+        if (ssl.enabled === false)
+            return false;
+        const result = {
+            rejectUnauthorized: ssl.reject_unauthorized !== false,
+        };
+        if (ssl.ca) {
+            const caPath = this.validateSslPath(ssl.ca, 'CA certificate');
+            result.ca = fs.readFileSync(caPath, 'utf8');
+        }
+        if (ssl.cert) {
+            const certPath = this.validateSslPath(ssl.cert, 'client certificate');
+            result.cert = fs.readFileSync(certPath, 'utf8');
+        }
+        if (ssl.key) {
+            const keyPath = this.validateSslPath(ssl.key, 'client key');
+            result.key = fs.readFileSync(keyPath, 'utf8');
+        }
+        return result;
+    }
+    validateSslPath(filePath, label) {
+        const resolved = path.resolve(filePath);
+        if (resolved !== path.normalize(resolved)) {
+            throw new Error(`SSL ${label} path contains invalid sequences: ${filePath}`);
+        }
+        if (!fs.existsSync(resolved)) {
+            throw new Error(`SSL ${label} not found: ${filePath}`);
+        }
+        return resolved;
+    }
+    async shutdown() {
+        if (this.knex) {
+            await this.knex.destroy();
+            this.knex = null;
+        }
+    }
+    async migrateSchema() {
+        const knex = this.getKnex();
+        const exists = await knex.schema.hasTable('schedules');
+        if (!exists) {
+            await knex.schema.createTable('schedules', table => {
+                table.string('id', 36).primary();
+                table.string('creator_id', 255).notNullable().index();
+                table.string('creator_context', 255);
+                table.string('creator_name', 255);
+                table.string('timezone', 64).notNullable().defaultTo('UTC');
+                table.string('schedule_expr', 255);
+                table.bigInteger('run_at');
+                table.boolean('is_recurring').notNullable();
+                table.text('original_expression');
+                table.string('workflow', 255);
+                table.text('workflow_inputs');
+                table.text('output_context');
+                table.string('status', 20).notNullable().index();
+                table.bigInteger('created_at').notNullable();
+                table.bigInteger('last_run_at');
+                table.bigInteger('next_run_at');
+                table.integer('run_count').notNullable().defaultTo(0);
+                table.integer('failure_count').notNullable().defaultTo(0);
+                table.text('last_error');
+                table.text('previous_response');
+                table.index(['status', 'next_run_at']);
+            });
+        }
+        // Create scheduler_locks table for distributed locking
+        const locksExist = await knex.schema.hasTable('scheduler_locks');
+        if (!locksExist) {
+            await knex.schema.createTable('scheduler_locks', table => {
+                table.string('lock_id', 255).primary();
+                table.string('node_id', 255).notNullable();
+                table.string('lock_token', 36).notNullable();
+                table.bigInteger('acquired_at').notNullable();
+                table.bigInteger('expires_at').notNullable();
+            });
+        }
+    }
+    getKnex() {
+        if (!this.knex) {
+            throw new Error('[KnexStore] Not initialized. Call initialize() first.');
+        }
+        return this.knex;
+    }
+    // --- CRUD ---
+    async create(schedule) {
+        const knex = this.getKnex();
+        const newSchedule = {
+            ...schedule,
+            id: (0, uuid_1.v4)(),
+            createdAt: Date.now(),
+            runCount: 0,
+            failureCount: 0,
+            status: 'active',
+        };
+        await knex('schedules').insert(toInsertRow(newSchedule));
+        logger_1.logger.info(`[KnexStore] Created schedule ${newSchedule.id} for user ${newSchedule.creatorId}`);
+        return newSchedule;
+    }
+    async importSchedule(schedule) {
+        const knex = this.getKnex();
+        const existing = await knex('schedules').where('id', schedule.id).first();
+        if (existing)
+            return; // Already imported (idempotent)
+        await knex('schedules').insert(toInsertRow(schedule));
+    }
+    async get(id) {
+        const knex = this.getKnex();
+        const row = await knex('schedules').where('id', id).first();
+        return row ? fromDbRow(row) : undefined;
+    }
+    async update(id, patch) {
+        const knex = this.getKnex();
+        const existing = await knex('schedules').where('id', id).first();
+        if (!existing)
+            return undefined;
+        const current = fromDbRow(existing);
+        const updated = { ...current, ...patch, id: current.id };
+        const row = toInsertRow(updated);
+        // Remove id from update (PK cannot change)
+        delete row.id;
+        await knex('schedules').where('id', id).update(row);
+        return updated;
+    }
+    async delete(id) {
+        const knex = this.getKnex();
+        const deleted = await knex('schedules').where('id', id).del();
+        if (deleted > 0) {
+            logger_1.logger.info(`[KnexStore] Deleted schedule ${id}`);
+            return true;
+        }
+        return false;
+    }
+    // --- Queries ---
+    async getByCreator(creatorId) {
+        const knex = this.getKnex();
+        const rows = await knex('schedules').where('creator_id', creatorId);
+        return rows.map((r) => fromDbRow(r));
+    }
+    async getActiveSchedules() {
+        const knex = this.getKnex();
+        const rows = await knex('schedules').where('status', 'active');
+        return rows.map((r) => fromDbRow(r));
+    }
+    async getDueSchedules(now) {
+        const ts = now ?? Date.now();
+        const knex = this.getKnex();
+        // MSSQL uses 1/0 for booleans
+        const bFalse = this.driver === 'mssql' ? 0 : false;
+        const bTrue = this.driver === 'mssql' ? 1 : true;
+        const rows = await knex('schedules')
+            .where('status', 'active')
+            .andWhere(function () {
+            this.where(function () {
+                this.where('is_recurring', bFalse)
+                    .whereNotNull('run_at')
+                    .where('run_at', '<=', ts);
+            }).orWhere(function () {
+                this.where('is_recurring', bTrue)
+                    .whereNotNull('next_run_at')
+                    .where('next_run_at', '<=', ts);
+            });
+        });
+        return rows.map((r) => fromDbRow(r));
+    }
+    async findByWorkflow(creatorId, workflowName) {
+        const knex = this.getKnex();
+        const escaped = workflowName.toLowerCase().replace(/[%_\\]/g, '\\$&');
+        const pattern = `%${escaped}%`;
+        const rows = await knex('schedules')
+            .where('creator_id', creatorId)
+            .where('status', 'active')
+            .whereRaw("LOWER(workflow) LIKE ? ESCAPE '\\'", [pattern]);
+        return rows.map((r) => fromDbRow(r));
+    }
+    async getAll() {
+        const knex = this.getKnex();
+        const rows = await knex('schedules');
+        return rows.map((r) => fromDbRow(r));
+    }
+    async getStats() {
+        const knex = this.getKnex();
+        // MSSQL uses 1/0 for booleans; PostgreSQL/MySQL accept both true/1
+        const boolTrue = this.driver === 'mssql' ? '1' : 'true';
+        const boolFalse = this.driver === 'mssql' ? '0' : 'false';
+        const result = await knex('schedules')
+            .select(knex.raw('COUNT(*) as total'), knex.raw("SUM(CASE WHEN status = 'active' THEN 1 ELSE 0 END) as active"), knex.raw("SUM(CASE WHEN status = 'paused' THEN 1 ELSE 0 END) as paused"), knex.raw("SUM(CASE WHEN status = 'completed' THEN 1 ELSE 0 END) as completed"), knex.raw("SUM(CASE WHEN status = 'failed' THEN 1 ELSE 0 END) as failed"), knex.raw(`SUM(CASE WHEN is_recurring = ${boolTrue} THEN 1 ELSE 0 END) as recurring`), knex.raw(`SUM(CASE WHEN is_recurring = ${boolFalse} THEN 1 ELSE 0 END) as one_time`))
+            .first();
+        return {
+            total: Number(result.total) || 0,
+            active: Number(result.active) || 0,
+            paused: Number(result.paused) || 0,
+            completed: Number(result.completed) || 0,
+            failed: Number(result.failed) || 0,
+            recurring: Number(result.recurring) || 0,
+            oneTime: Number(result.one_time) || 0,
+        };
+    }
+    async validateLimits(creatorId, isRecurring, limits) {
+        const knex = this.getKnex();
+        if (limits.maxGlobal) {
+            const result = await knex('schedules').count('* as cnt').first();
+            if (Number(result?.cnt) >= limits.maxGlobal) {
+                throw new Error(`Global schedule limit reached (${limits.maxGlobal})`);
+            }
+        }
+        if (limits.maxPerUser) {
+            const result = await knex('schedules')
+                .where('creator_id', creatorId)
+                .count('* as cnt')
+                .first();
+            if (Number(result?.cnt) >= limits.maxPerUser) {
+                throw new Error(`You have reached the maximum number of schedules (${limits.maxPerUser})`);
+            }
+        }
+        if (isRecurring && limits.maxRecurringPerUser) {
+            const bTrue = this.driver === 'mssql' ? 1 : true;
+            const result = await knex('schedules')
+                .where('creator_id', creatorId)
+                .where('is_recurring', bTrue)
+                .count('* as cnt')
+                .first();
+            if (Number(result?.cnt) >= limits.maxRecurringPerUser) {
+                throw new Error(`You have reached the maximum number of recurring schedules (${limits.maxRecurringPerUser})`);
+            }
+        }
+    }
+    // --- HA Distributed Locking (via scheduler_locks table) ---
+    async tryAcquireLock(lockId, nodeId, ttlSeconds) {
+        const knex = this.getKnex();
+        const now = Date.now();
+        const expiresAt = now + ttlSeconds * 1000;
+        const token = (0, uuid_1.v4)();
+        // Step 1: Try to claim an existing expired lock
+        const updated = await knex('scheduler_locks')
+            .where('lock_id', lockId)
+            .where('expires_at', '<', now)
+            .update({
+            node_id: nodeId,
+            lock_token: token,
+            acquired_at: now,
+            expires_at: expiresAt,
+        });
+        if (updated > 0)
+            return token;
+        // Step 2: Try to INSERT a new lock row
+        try {
+            await knex('scheduler_locks').insert({
+                lock_id: lockId,
+                node_id: nodeId,
+                lock_token: token,
+                acquired_at: now,
+                expires_at: expiresAt,
+            });
+            return token;
+        }
+        catch {
+            // Unique constraint violation — another node holds the lock
+            return null;
+        }
+    }
+    async releaseLock(lockId, lockToken) {
+        const knex = this.getKnex();
+        await knex('scheduler_locks').where('lock_id', lockId).where('lock_token', lockToken).del();
+    }
+    async renewLock(lockId, lockToken, ttlSeconds) {
+        const knex = this.getKnex();
+        const now = Date.now();
+        const expiresAt = now + ttlSeconds * 1000;
+        const updated = await knex('scheduler_locks')
+            .where('lock_id', lockId)
+            .where('lock_token', lockToken)
+            .update({ acquired_at: now, expires_at: expiresAt });
+        return updated > 0;
+    }
+    async flush() {
+        // No-op for server-based backends
+    }
+}
+exports.KnexStoreBackend = KnexStoreBackend;
+
+
 /***/ }),
 
 /***/ 83864:
@@ -172580,9 +174287,16 @@ exports.createAuthenticatedOctokit = createAuthenticatedOctokit;
 exports.resolveAuthFromEnvironment = resolveAuthFromEnvironment;
 exports.resolvePrivateKey = resolvePrivateKey;
 exports.injectGitHubCredentials = injectGitHubCredentials;
+exports.markTokenFresh = markTokenFresh;
+exports.refreshGitHubCredentials = refreshGitHubCredentials;
+exports.startTokenRefreshTimer = startTokenRefreshTimer;
+exports.stopTokenRefreshTimer = stopTokenRefreshTimer;
+exports._testSetCachedToken = _testSetCachedToken;
+exports._testGetCachedToken = _testGetCachedToken;
 const rest_1 = __nccwpck_require__(47432);
 const fs = __importStar(__nccwpck_require__(79896));
 const path = __importStar(__nccwpck_require__(16928));
+const logger_1 = __nccwpck_require__(86999);
 /**
  * Create an authenticated Octokit instance.
  * Returns undefined if no credentials are provided (auth is optional in CLI mode).
@@ -172681,6 +174395,11 @@ function resolvePrivateKey(keyOrPath) {
     // Return as-is and let the auth library handle errors
     return keyOrPath;
 }
+// Track our auth entries position so repeated calls replace instead of stacking.
+// _authBase: the GIT_CONFIG index where our 2 auth entries start.
+// _lastWrittenCount: what we last set GIT_CONFIG_COUNT to (detects external changes).
+let _authBase;
+let _lastWrittenCount;
 /**
  * Inject GitHub credentials into process.env for child processes.
  *
@@ -172692,22 +174411,148 @@ function resolvePrivateKey(keyOrPath) {
  * - No temp files or global config mutation
  * - Inherited by all child processes automatically
  * - Works regardless of local git configuration
+ *
+ * Safe to call multiple times (e.g. on token refresh) — replaces previous entries.
  */
 function injectGitHubCredentials(token) {
     // Set for gh CLI and general GitHub API usage
     process.env.GITHUB_TOKEN = token;
     process.env.GH_TOKEN = token;
+    const currentCount = parseInt(process.env.GIT_CONFIG_COUNT || '0', 10);
+    // Determine where to write our 2 auth entries:
+    // - First call: append after any pre-existing entries
+    // - Subsequent calls with unchanged count: overwrite at same position
+    // - If count changed externally: someone added entries, append after them
+    let base;
+    if (_authBase === undefined) {
+        base = currentCount;
+    }
+    else if (_lastWrittenCount !== undefined && currentCount !== _lastWrittenCount) {
+        base = currentCount;
+    }
+    else {
+        base = _authBase;
+    }
+    _authBase = base;
     // Configure git HTTPS auth via url.<base>.insteadOf
-    // This rewrites all github.com URLs to include the access token
-    const existingCount = parseInt(process.env.GIT_CONFIG_COUNT || '0', 10);
     const authUrl = `https://x-access-token:${token}@github.com/`;
     // Rewrite HTTPS URLs
-    process.env[`GIT_CONFIG_KEY_${existingCount}`] = `url.${authUrl}.insteadOf`;
-    process.env[`GIT_CONFIG_VALUE_${existingCount}`] = 'https://github.com/';
+    process.env[`GIT_CONFIG_KEY_${base}`] = `url.${authUrl}.insteadOf`;
+    process.env[`GIT_CONFIG_VALUE_${base}`] = 'https://github.com/';
     // Rewrite SSH-style URLs (git@github.com:org/repo)
-    process.env[`GIT_CONFIG_KEY_${existingCount + 1}`] = `url.${authUrl}.insteadOf`;
-    process.env[`GIT_CONFIG_VALUE_${existingCount + 1}`] = 'git@github.com:';
-    process.env.GIT_CONFIG_COUNT = String(existingCount + 2);
+    process.env[`GIT_CONFIG_KEY_${base + 1}`] = `url.${authUrl}.insteadOf`;
+    process.env[`GIT_CONFIG_VALUE_${base + 1}`] = 'git@github.com:';
+    const newCount = base + 2;
+    process.env.GIT_CONFIG_COUNT = String(newCount);
+    _lastWrittenCount = newCount;
+}
+/**
+ * Mark the current token as freshly generated (for use after initial startup auth).
+ * Prevents the first refreshGitHubCredentials() call from unnecessarily regenerating.
+ */
+function markTokenFresh() {
+    const token = process.env.GITHUB_TOKEN || process.env.GH_TOKEN;
+    if (token) {
+        _cachedAppToken = { token, generatedAt: Date.now() };
+    }
+}
+// Cached token with generation timestamp for expiry checks
+let _cachedAppToken;
+// Installation tokens live 1 hour; refresh after 45 minutes.
+// Using 45 min (not 50) leaves a 15-minute buffer for long-running tasks
+// that start right before a refresh cycle.
+const TOKEN_REFRESH_MS = 45 * 60 * 1000;
+// Background refresh timer
+let _refreshTimer;
+// How often the background timer checks (30 minutes)
+const TIMER_INTERVAL_MS = 30 * 60 * 1000;
+/**
+ * Refresh GitHub App installation credentials if they are about to expire.
+ *
+ * No-op when:
+ * - No GitHub App credentials are configured (GITHUB_APP_ID + GITHUB_APP_PRIVATE_KEY)
+ * - The current token was generated less than 45 minutes ago
+ *
+ * Call this before each execution in long-running processes (Slack bot, scheduler)
+ * to ensure child processes always have a valid token for git/gh operations.
+ */
+async function refreshGitHubCredentials() {
+    // Quick check: do we have App credentials?
+    const appId = process.env.GITHUB_APP_ID;
+    const privateKey = process.env.GITHUB_APP_PRIVATE_KEY;
+    if (!appId || !privateKey)
+        return;
+    // Skip if cached token is still fresh
+    const now = Date.now();
+    if (_cachedAppToken && now - _cachedAppToken.generatedAt < TOKEN_REFRESH_MS) {
+        return;
+    }
+    try {
+        const opts = resolveAuthFromEnvironment();
+        const result = await createAuthenticatedOctokit(opts);
+        if (result && result.authType === 'github-app') {
+            injectGitHubCredentials(result.token);
+            _cachedAppToken = { token: result.token, generatedAt: now };
+            logger_1.logger.debug('[github-auth] Refreshed GitHub App installation token');
+        }
+    }
+    catch (err) {
+        const age = _cachedAppToken
+            ? `${Math.round((now - _cachedAppToken.generatedAt) / 60000)}min old`
+            : 'no cached token';
+        logger_1.logger.warn(`[github-auth] Failed to refresh GitHub App token (${age}): ${err instanceof Error ? err.message : String(err)}. ` +
+            'Child processes may fail with authentication errors.');
+    }
+}
+/**
+ * Start a background timer that refreshes GitHub App tokens every 30 minutes.
+ *
+ * This ensures tokens stay fresh even during long-running tasks (e.g., an engineer
+ * task that takes 40+ minutes). Without this, a token generated at startup could
+ * expire mid-execution of a child process.
+ *
+ * The timer is unref'd so it doesn't prevent Node from exiting.
+ * Call stopTokenRefreshTimer() on shutdown.
+ */
+function startTokenRefreshTimer() {
+    if (_refreshTimer)
+        return; // Already running
+    // Only start if we have App credentials
+    const appId = process.env.GITHUB_APP_ID;
+    const privateKey = process.env.GITHUB_APP_PRIVATE_KEY;
+    if (!appId || !privateKey)
+        return;
+    _refreshTimer = setInterval(() => {
+        refreshGitHubCredentials().catch(err => {
+            logger_1.logger.warn(`[github-auth] Background token refresh failed: ${err instanceof Error ? err.message : String(err)}`);
+        });
+    }, TIMER_INTERVAL_MS);
+    // Don't prevent Node from exiting
+    _refreshTimer.unref();
+    logger_1.logger.debug('[github-auth] Background token refresh timer started (every 30 min)');
+}
+/**
+ * Stop the background token refresh timer.
+ */
+function stopTokenRefreshTimer() {
+    if (_refreshTimer) {
+        clearInterval(_refreshTimer);
+        _refreshTimer = undefined;
+        logger_1.logger.debug('[github-auth] Background token refresh timer stopped');
+    }
+}
+/** Visible for testing: override the cached token state. */
+function _testSetCachedToken(token, generatedAt) {
+    if (token) {
+        _cachedAppToken = { token, generatedAt: generatedAt ?? Date.now() };
+    }
+    else {
+        _cachedAppToken = undefined;
+    }
+}
+/** Visible for testing: get the current cached token info. */
+function _testGetCachedToken() {
+    return _cachedAppToken;
 }
 
 
@@ -177693,6 +179538,35 @@ class OutputFormatters {
 exports.OutputFormatters = OutputFormatters;
 
 
+/***/ }),
+
+/***/ 93866:
+/***/ ((__unused_webpack_module, exports) => {
+
+"use strict";
+
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.DefaultPolicyEngine = void 0;
+/**
+ * Default (no-op) policy engine — always allows everything.
+ * Used when no enterprise license is present or policy is disabled.
+ */
+class DefaultPolicyEngine {
+    async initialize(_config) { }
+    async evaluateCheckExecution(_checkId, _checkConfig) {
+        return { allowed: true };
+    }
+    async evaluateToolInvocation(_serverName, _methodName, _transport) {
+        return { allowed: true };
+    }
+    async evaluateCapabilities(_checkId, _capabilities) {
+        return { allowed: true };
+    }
+    async shutdown() { }
+}
+exports.DefaultPolicyEngine = DefaultPolicyEngine;
+
+
 /***/ }),
 
 /***/ 96611:
@@ -190216,10 +192090,12 @@ class BubblewrapSandbox {
     name;
     config;
     repoPath;
-    constructor(name, config, repoPath) {
+    visorDistPath;
+    constructor(name, config, repoPath, visorDistPath) {
         this.name = name;
         this.config = config;
         this.repoPath = (0, path_1.resolve)(repoPath);
+        this.visorDistPath = (0, path_1.resolve)(visorDistPath);
     }
     /**
      * Check if bwrap binary is available on the system.
@@ -190308,6 +192184,9 @@ class BubblewrapSandbox {
         else {
             args.push('--bind', this.repoPath, workdir);
         }
+        // Visor dist mount (read-only) — required for child visor process
+        const visorPath = this.config.visor_path || '/opt/visor';
+        args.push('--ro-bind', this.visorDistPath, visorPath);
         // Working directory inside sandbox
         args.push('--chdir', workdir);
         // Namespace isolation
@@ -191229,14 +193108,14 @@ class SandboxManager {
         // Bubblewrap engine: ephemeral per-exec, no persistent container
         if (config.engine === 'bubblewrap') {
             const { BubblewrapSandbox } = __nccwpck_require__(11207);
-            const instance = new BubblewrapSandbox(name, config, this.repoPath);
+            const instance = new BubblewrapSandbox(name, config, this.repoPath, this.visorDistPath);
             this.instances.set(name, instance);
             return instance;
         }
         // Seatbelt engine: macOS sandbox-exec, ephemeral per-exec
         if (config.engine === 'seatbelt') {
             const { SeatbeltSandbox } = __nccwpck_require__(46429);
-            const instance = new SeatbeltSandbox(name, config, this.repoPath);
+            const instance = new SeatbeltSandbox(name, config, this.repoPath, this.visorDistPath);
             this.instances.set(name, instance);
             return instance;
         }
@@ -191395,12 +193274,14 @@ class SeatbeltSandbox {
     name;
     config;
     repoPath;
-    constructor(name, config, repoPath) {
+    visorDistPath;
+    constructor(name, config, repoPath, visorDistPath) {
         this.name = name;
         this.config = config;
         // Resolve symlinks — macOS has /var → /private/var, /tmp → /private/tmp etc.
         // sandbox-exec operates on real paths, so we must resolve before building profiles.
         this.repoPath = (0, fs_1.realpathSync)((0, path_1.resolve)(repoPath));
+        this.visorDistPath = (0, fs_1.realpathSync)((0, path_1.resolve)(visorDistPath));
     }
     /**
      * Check if sandbox-exec binary is available on the system.
@@ -191513,6 +193394,9 @@ class SeatbeltSandbox {
         if (!this.config.read_only) {
             lines.push(`(allow file-write* (subpath "${repoPath}"))`);
         }
+        // Visor dist read access — required for child visor process
+        const visorDistPath = this.escapePath(this.visorDistPath);
+        lines.push(`(allow file-read* (subpath "${visorDistPath}"))`);
         // Network access (unless explicitly disabled)
         if (this.config.network !== false) {
             lines.push('(allow network*)');
@@ -193714,6 +195598,39 @@ function buildScheduleToolContext(sources, availableWorkflows, permissions, outp
 
 "use strict";
 
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
 var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
@@ -194305,6 +196222,12 @@ class Scheduler {
         const webhookData = new Map();
         const endpoint = '/scheduler/trigger';
         webhookData.set(endpoint, syntheticPayload);
+        // Refresh GitHub App installation token (no-op if not using App auth or still fresh)
+        try {
+            const { refreshGitHubCredentials } = await Promise.resolve().then(() => __importStar(__nccwpck_require__(11347)));
+            await refreshGitHubCredentials();
+        }
+        catch { }
         // Use common preparation helper
         const { engine: runEngine, config: cfgForRun } = this.prepareExecution(schedule);
         // Execute the workflow
@@ -194419,6 +196342,12 @@ Please provide an updated response based on the reminder above. You may referenc
                 logger_1.logger.warn(`[Scheduler] Execution preparation failed: ${error instanceof Error ? error.message : error}`);
             }
         }
+        // Refresh GitHub App installation token (no-op if not using App auth or still fresh)
+        try {
+            const { refreshGitHubCredentials } = await Promise.resolve().then(() => __importStar(__nccwpck_require__(11347)));
+            await refreshGitHubCredentials();
+        }
+        catch { }
         // Use common execution helper
         const { engine: runEngine, config: cfgForRun, responseRef, } = this.prepareExecution(schedule, reminderText);
         try {
@@ -197230,6 +199159,12 @@ class SlackSocketRunner {
         catch (e) {
             logger_1.logger.warn(`[SlackSocket] Scheduler init failed: ${e instanceof Error ? e.message : e}`);
         }
+        // Start background GitHub App token refresh timer (no-op if no App credentials)
+        try {
+            const { startTokenRefreshTimer } = await Promise.resolve().then(() => __importStar(__nccwpck_require__(11347)));
+            startTokenRefreshTimer();
+        }
+        catch { }
         const url = await this.openConnection();
         await this.connect(url);
         // Clean up stale workspace directories from previous runs
@@ -197559,6 +199494,13 @@ class SlackSocketRunner {
                 mgr.setFirstMessage(ch, rootTs, cleaned);
         }
         catch { }
+        // Refresh GitHub App installation token before each run.
+        // Installation tokens expire after 1 hour; this is a no-op if still fresh.
+        try {
+            const { refreshGitHubCredentials } = await Promise.resolve().then(() => __importStar(__nccwpck_require__(11347)));
+            await refreshGitHubCredentials();
+        }
+        catch { }
         logger_1.logger.info('[SlackSocket] Dispatching engine run for Slack event');
         try {
             // Rate limiting (optional)
@@ -197651,6 +199593,12 @@ class SlackSocketRunner {
      * Stop the socket runner and clean up resources
      */
     async stop() {
+        // Stop background GitHub App token refresh
+        try {
+            const { stopTokenRefreshTimer } = await Promise.resolve().then(() => __importStar(__nccwpck_require__(11347)));
+            stopTokenRefreshTimer();
+        }
+        catch { }
         // Stop the generic scheduler if active
         if (this.genericScheduler) {
             try {
@@ -198286,7 +200234,7 @@ class StateMachineExecutionEngine {
             try {
                 logger_1.logger.debug(`[PolicyEngine] Loading enterprise policy engine (engine=${configWithTagFilter.policy.engine})`);
                 // @ts-ignore — enterprise/ may not exist in OSS builds (caught at runtime)
-                const { loadEnterprisePolicyEngine } = await Promise.resolve().then(() => __importStar(__nccwpck_require__(7065)));
+                const { loadEnterprisePolicyEngine } = await Promise.resolve().then(() => __importStar(__nccwpck_require__(87068)));
                 context.policyEngine = await loadEnterprisePolicyEngine(configWithTagFilter.policy);
                 logger_1.logger.debug(`[PolicyEngine] Initialized: ${context.policyEngine?.constructor?.name || 'unknown'}`);
             }
@@ -208550,7 +210498,7 @@ async function initTelemetry(opts = {}) {
                 const path = __nccwpck_require__(16928);
                 const outDir = opts.file?.dir ||
                     process.env.VISOR_TRACE_DIR ||
-                    __nccwpck_require__.ab + "traces";
+                    path.join(process.cwd(), 'output', 'traces');
                 fs.mkdirSync(outDir, { recursive: true });
                 const ts = new Date().toISOString().replace(/[:.]/g, '-');
                 process.env.VISOR_FALLBACK_TRACE_FILE = path.join(outDir, `run-${ts}.ndjson`);
@@ -208755,7 +210703,7 @@ async function shutdownTelemetry() {
             if (process.env.VISOR_TRACE_REPORT === 'true') {
                 const fs = __nccwpck_require__(79896);
                 const path = __nccwpck_require__(16928);
-                const outDir = process.env.VISOR_TRACE_DIR || __nccwpck_require__.ab + "traces";
+                const outDir = process.env.VISOR_TRACE_DIR || path.join(process.cwd(), 'output', 'traces');
                 if (!fs.existsSync(outDir))
                     fs.mkdirSync(outDir, { recursive: true });
                 const ts = new Date().toISOString().replace(/[:.]/g, '-');
@@ -209254,7 +211202,7 @@ function __getOrCreateNdjsonPath() {
                 fs.mkdirSync(dir, { recursive: true });
             return __ndjsonPath;
         }
-        const outDir = process.env.VISOR_TRACE_DIR || __nccwpck_require__.ab + "traces";
+        const outDir = process.env.VISOR_TRACE_DIR || path.join(process.cwd(), 'output', 'traces');
         if (!fs.existsSync(outDir))
             fs.mkdirSync(outDir, { recursive: true });
         if (!__ndjsonPath) {
@@ -209831,7 +211779,8 @@ class FlowStage {
     defaultIncludeTags;
     defaultExcludeTags;
     defaultFrontends;
-    constructor(flowName, engine, recorder, cfg, prompts, promptCap, mapEventFromFixtureName, computeChecksToRun, printStageHeader, printSelectedChecks, warnUnmockedProviders, defaultIncludeTags, defaultExcludeTags, defaultFrontends) {
+    noMocks;
+    constructor(flowName, engine, recorder, cfg, prompts, promptCap, mapEventFromFixtureName, computeChecksToRun, printStageHeader, printSelectedChecks, warnUnmockedProviders, defaultIncludeTags, defaultExcludeTags, defaultFrontends, noMocks) {
         this.flowName = flowName;
         this.engine = engine;
         this.recorder = recorder;
@@ -209846,6 +211795,7 @@ class FlowStage {
         this.defaultIncludeTags = defaultIncludeTags;
         this.defaultExcludeTags = defaultExcludeTags;
         this.defaultFrontends = defaultFrontends;
+        this.noMocks = noMocks;
     }
     async run(stage, flowCase, strict) {
         const fixtureInput = typeof stage.fixture === 'object' && stage.fixture
@@ -209886,7 +211836,17 @@ class FlowStage {
                     this.prompts[k].push(p);
                     // prompts are captured for assertions only — no ad-hoc console/file output
                 },
-                mockForStep: (step) => mockMgr.get(step),
+                mockForStep: (step) => {
+                    if (this.noMocks)
+                        return undefined;
+                    const raw = mockMgr.get(step);
+                    // Strip tool_calls from mock value — handled separately for stageHist injection
+                    if (raw && typeof raw === 'object' && 'tool_calls' in raw) {
+                        const { tool_calls: _unused, ...rest } = raw; // eslint-disable-line @typescript-eslint/no-unused-vars
+                        return rest;
+                    }
+                    return raw;
+                },
             },
         });
         // (debug cleanup) removed stage-debug prints
@@ -210052,6 +212012,26 @@ class FlowStage {
             for (const [k, arr] of Object.entries(outHistory || {})) {
                 stageHist[k] = Array.isArray(arr) ? arr : [];
             }
+            // Inject synthetic outputHistory entries for tool_calls declared in mocks.
+            // When a mock (e.g. generate-response) declares tool_calls, the AI never runs
+            // and no workflow tools are invoked. This injects entries so the evaluator
+            // counts them as executed steps, enabling at_least assertions in mock mode.
+            if (!this.noMocks) {
+                for (const [, mockVal] of Object.entries(mergedMocks)) {
+                    if (mockVal && typeof mockVal === 'object' && 'tool_calls' in mockVal) {
+                        const toolCalls = mockVal.tool_calls;
+                        if (Array.isArray(toolCalls)) {
+                            for (const tc of toolCalls) {
+                                if (tc && typeof tc === 'object' && typeof tc.step === 'string') {
+                                    if (!stageHist[tc.step])
+                                        stageHist[tc.step] = [];
+                                    stageHist[tc.step].push(tc.output !== undefined ? tc.output : {});
+                                }
+                            }
+                        }
+                    }
+                }
+            }
             try {
                 if (process.env.VISOR_DEBUG === 'true') {
                     const parts = Object.entries(stageHist)
@@ -211062,6 +213042,7 @@ exports.runMvp = runMvp;
 exports.validateTestsOnly = validateTestsOnly;
 const fs_1 = __importDefault(__nccwpck_require__(79896));
 const path_1 = __importDefault(__nccwpck_require__(16928));
+const child_process_1 = __nccwpck_require__(35317);
 const yaml = __importStar(__nccwpck_require__(74281));
 const config_1 = __nccwpck_require__(22973);
 const state_machine_execution_engine_1 = __nccwpck_require__(39004);
@@ -211291,6 +213272,36 @@ async function runSuites(files, options) {
 function isObject(v) {
     return !!v && typeof v === 'object' && !Array.isArray(v);
 }
+function checkRequirements(requires) {
+    if (!requires)
+        return { met: true };
+    const reqs = Array.isArray(requires) ? requires : [requires];
+    for (const req of reqs) {
+        switch (req.toLowerCase()) {
+            case 'linux':
+                if (process.platform !== 'linux')
+                    return { met: false, reason: `requires linux (got ${process.platform})` };
+                break;
+            case 'darwin':
+                if (process.platform !== 'darwin')
+                    return { met: false, reason: `requires darwin (got ${process.platform})` };
+                break;
+            case 'windows':
+                if (process.platform !== 'win32')
+                    return { met: false, reason: `requires windows (got ${process.platform})` };
+                break;
+            default:
+                // Treat as tool name — check availability via `which`
+                try {
+                    (0, child_process_1.execFileSync)('which', [req], { timeout: 5000, stdio: 'ignore' });
+                }
+                catch {
+                    return { met: false, reason: `'${req}' not found in PATH` };
+                }
+        }
+    }
+    return { met: true };
+}
 class VisorTestRunner {
     cwd;
     constructor(cwd = process.cwd()) {
@@ -211807,7 +213818,11 @@ class VisorTestRunner {
         const defaultIncludeTags = parseTags(defaultsAny?.tags);
         const defaultExcludeTags = parseTags(defaultsAny?.exclude_tags);
         // Test overrides: force AI provider to 'mock' when requested (default: mock per RFC)
+        // In --no-mocks mode, skip the mock provider override so real AI providers execute.
         const cfg = JSON.parse(JSON.stringify(config));
+        const noMocksAll = options.noMocks || false;
+        const noMocksForAi = !noMocksAll && options.noMocksFor ? options.noMocksFor.includes('ai') : false;
+        const skipAiMockOverride = noMocksAll || noMocksForAi;
         const allowCtxEnv = String(process.env.VISOR_TEST_ALLOW_CODE_CONTEXT || '').toLowerCase() === 'true';
         const forceNoCtxEnv = String(process.env.VISOR_TEST_FORCE_NO_CODE_CONTEXT || '').toLowerCase() === 'true';
         for (const name of Object.keys(cfg.checks || {})) {
@@ -211821,13 +213836,23 @@ class VisorTestRunner {
                     : allowCtxEnv
                         ? false
                         : prev.skip_code_context;
-                chk.ai = {
-                    ...prev,
-                    provider: aiProviderDefault,
-                    ...(skipCtx === undefined ? {} : { skip_code_context: skipCtx }),
-                    disable_tools: true,
-                    timeout: Math.min(15000, prev.timeout || 15000),
-                };
+                if (skipAiMockOverride) {
+                    // --no-mocks or --no-mocks-for ai: keep the original provider/timeout/tools,
+                    // only apply code-context overrides if requested.
+                    chk.ai = {
+                        ...prev,
+                        ...(skipCtx === undefined ? {} : { skip_code_context: skipCtx }),
+                    };
+                }
+                else {
+                    chk.ai = {
+                        ...prev,
+                        provider: aiProviderDefault,
+                        ...(skipCtx === undefined ? {} : { skip_code_context: skipCtx }),
+                        disable_tools: true,
+                        timeout: Math.min(15000, prev.timeout || 15000),
+                    };
+                }
                 cfg.checks[name] = chk;
             }
         }
@@ -211847,7 +213872,12 @@ class VisorTestRunner {
             console.log(`Suite: ${__suiteRel}`);
             if (noMocksMode) {
                 console.log(this.color('🔴 NO-MOCKS MODE: Running with real providers (no mock injection)', '33'));
-                console.log(this.gray('   Step outputs will be captured and printed as suggested mocks\n'));
+                console.log(this.gray('   Step outputs will be captured and printed as suggested mocks'));
+                if (process.env.VISOR_TELEMETRY_ENABLED === 'true') {
+                    const traceDir = process.env.VISOR_TRACE_DIR || 'output/traces';
+                    console.log(this.gray(`   Tracing enabled → ${traceDir}`));
+                }
+                console.log();
             }
             else if (noMocksForTypes && noMocksForTypes.length > 0) {
                 console.log(this.color(`🟡 PARTIAL-MOCK MODE: Real providers for: ${noMocksForTypes.join(', ')}`, '33'));
@@ -211865,8 +213895,14 @@ class VisorTestRunner {
                 caseResults.push({ name: _case.name, passed: true, /* annotate skip */ errors: [] });
                 return { name: _case.name, failed: 0 };
             }
+            const reqResult = checkRequirements(_case.requires);
+            if (!reqResult.met) {
+                console.log(`⏭ SKIP ${_case.name} (${reqResult.reason})`);
+                caseResults.push({ name: _case.name, passed: true, errors: [] });
+                return { name: _case.name, failed: 0 };
+            }
             if (Array.isArray(_case.flow) && _case.flow.length > 0) {
-                const flowRes = await this.runFlowCase(_case, cfg, defaultStrict, options.bail || false, defaultPromptCap, stageFilter);
+                const flowRes = await this.runFlowCase(_case, cfg, defaultStrict, options.bail || false, defaultPromptCap, stageFilter, noMocksMode);
                 const failed = flowRes.failures;
                 caseResults.push({ name: _case.name, passed: failed === 0, stages: flowRes.stages });
                 return { name: _case.name, failed };
@@ -212259,7 +214295,7 @@ class VisorTestRunner {
         clearInterval(__keepAlive);
         return { failures, results: caseResults };
     }
-    async runFlowCase(flowCase, cfg, defaultStrict, bail, promptCap, stageFilter) {
+    async runFlowCase(flowCase, cfg, defaultStrict, bail, promptCap, stageFilter, noMocks) {
         const suiteDefaults = this.suiteDefaults || {};
         const ghRec = suiteDefaults.github_recorder;
         const ghRecCase = typeof flowCase.github_recorder === 'object' && flowCase.github_recorder
@@ -212319,7 +214355,7 @@ class VisorTestRunner {
                 const suiteDefaults = this.suiteDefaults || {};
                 const defaultIncludeTags = parseTags(suiteDefaults?.tags);
                 const defaultExcludeTags = parseTags(suiteDefaults?.exclude_tags);
-                const stageRunner = new flow_stage_1.FlowStage(flowName, engine, recorder, cfg, prompts, promptCap, this.mapEventFromFixtureName.bind(this), this.computeChecksToRun.bind(this), this.printStageHeader.bind(this), this.printSelectedChecks.bind(this), this.warnUnmockedProviders.bind(this), defaultIncludeTags, defaultExcludeTags, (suiteDefaults.frontends || undefined));
+                const stageRunner = new flow_stage_1.FlowStage(flowName, engine, recorder, cfg, prompts, promptCap, this.mapEventFromFixtureName.bind(this), this.computeChecksToRun.bind(this), this.printStageHeader.bind(this), this.printSelectedChecks.bind(this), this.warnUnmockedProviders.bind(this), defaultIncludeTags, defaultExcludeTags, (suiteDefaults.frontends || undefined), noMocks);
                 const outcome = await stageRunner.run(stage, flowCase, strict);
                 const expect = stage.expect || {};
                 if (outcome.stats)
@@ -212973,6 +215009,8 @@ const schema = {
         frontends: { type: 'array' },
         workspace: { type: 'object' },
         scheduler: { type: 'object' },
+        sandboxes: { type: 'object' },
+        sandbox: { type: 'string' },
         // Workflow definition fields (for workflow files with co-located tests)
         id: { type: 'string' },
         name: { type: 'string' },
@@ -213062,6 +215100,9 @@ const schema = {
                 name: { type: 'string' },
                 description: { type: 'string' },
                 skip: { type: 'boolean' },
+                requires: {
+                    oneOf: [{ type: 'string' }, { type: 'array', items: { type: 'string' } }],
+                },
                 strict: { type: 'boolean' },
                 ai_include_code_context: { type: 'boolean' },
                 tags: {
@@ -213354,6 +215395,7 @@ const knownKeys = new Set([
     'name',
     'description',
     'skip',
+    'requires',
     'strict',
     'event',
     'fixture',
@@ -221164,7 +223206,7 @@ class WorktreeManager {
     /**
      * Get or create bare repository
      */
-    async getOrCreateBareRepo(repository, repoUrl, token, fetchDepth, cloneTimeoutMs) {
+    async getOrCreateBareRepo(repository, repoUrl, _token, fetchDepth, cloneTimeoutMs) {
         const reposDir = this.getReposDir();
         const repoName = repository.replace(/\//g, '-');
         const bareRepoPath = path.join(reposDir, `${repoName}.git`);
@@ -221184,13 +223226,25 @@ class WorktreeManager {
                 // Fall through to clone below
             }
             else {
+                // Refresh the remote URL with the current token so that fetch/push
+                // use valid credentials. The bare repo may have been cloned with a
+                // token that has since expired (GitHub App installation tokens live
+                // only 1 hour). Without this, git operations inside worktrees
+                // derived from this bare repo will fail with "Authentication failed".
+                // If the bare repo was cloned with a token embedded in the URL,
+                // reset it to the plain URL so git uses GIT_CONFIG insteadOf rules
+                // for auth (which always have the freshest token).
+                await this.resetBareRepoRemoteUrl(bareRepoPath, repoUrl);
                 // Update remote refs
                 await this.updateBareRepo(bareRepoPath);
                 return bareRepoPath;
             }
         }
-        // Clone as bare repository
-        const cloneUrl = this.buildAuthenticatedUrl(repoUrl, token);
+        // Clone as bare repository — use the plain URL, not buildAuthenticatedUrl().
+        // Auth is handled by GIT_CONFIG insteadOf rules (set by injectGitHubCredentials),
+        // which keeps the stored origin URL token-free. This prevents stale tokens from
+        // being baked into the bare repo's remote config.
+        const cloneUrl = repoUrl;
         const redactedUrl = this.redactUrl(cloneUrl);
         logger_1.logger.info(`Cloning bare repository: ${redactedUrl}${fetchDepth ? ` (depth: ${fetchDepth})` : ''}`);
         // Build clone command with optional depth
@@ -221289,6 +223343,33 @@ class WorktreeManager {
             return false;
         }
     }
+    /**
+     * Ensure the origin remote URL of a bare repo is a plain URL (no embedded token).
+     *
+     * Older bare repos may have been cloned with a token in the URL
+     * (https://x-access-token:TOKEN@github.com/...). This causes stale-token
+     * failures because GIT_CONFIG insteadOf rules can't rewrite URLs that
+     * already have credentials. Resetting to the plain URL lets insteadOf
+     * handle auth with the freshest token.
+     */
+    async resetBareRepoRemoteUrl(bareRepoPath, plainRepoUrl) {
+        try {
+            const cmd = `git -C ${this.escapeShellArg(bareRepoPath)} remote set-url origin ${this.escapeShellArg(plainRepoUrl)}`;
+            const result = await this.executeGitCommand(cmd, { timeout: 10000 });
+            if (result.exitCode !== 0) {
+                logger_1.logger.warn(`Failed to reset bare repo remote URL: ${result.stderr}. ` +
+                    'Git operations may fail with stale token if the URL has embedded credentials.');
+            }
+            else {
+                logger_1.logger.debug(`Reset bare repo remote URL to plain URL for ${bareRepoPath}`);
+            }
+        }
+        catch (error) {
+            const msg = error instanceof Error ? error.message : String(error);
+            logger_1.logger.warn(`Error resetting bare repo remote URL: ${msg}. ` +
+                'Git operations may fail with stale token if the URL has embedded credentials.');
+        }
+    }
     /**
      * Create a new worktree for the given repository/ref.
      *
@@ -222674,22 +224755,6 @@ class WorkflowRegistry {
 exports.WorkflowRegistry = WorkflowRegistry;
 
 
-/***/ }),
-
-/***/ 7065:
-/***/ ((module) => {
-
-module.exports = eval("require")("./enterprise/loader");
-
-
-/***/ }),
-
-/***/ 71370:
-/***/ ((module) => {
-
-module.exports = eval("require")("./enterprise/policy/policy-input-builder");
-
-
 /***/ }),
 
 /***/ 18327:
@@ -245474,7 +247539,7 @@ async function getPackageBinDir() {
 }
 async function findPackageRoot() {
   const debug = process.env.DEBUG === "1" || process.env.VERBOSE === "1";
-  let currentDir = __dirname;
+  let currentDir = __dirname2;
   const rootDir = import_path.default.parse(currentDir).root;
   if (debug) {
     console.log(`DEBUG: Starting package root search from: ${currentDir}`);
@@ -245548,7 +247613,7 @@ async function canWriteToDirectory(dirPath) {
     return false;
   }
 }
-var import_path, import_os, import_fs_extra, import_url, __filename, __dirname;
+var import_path, import_os, import_fs_extra, import_url, __filename, __dirname2;
 var init_directory_resolver = __esm({
   "src/directory-resolver.js"() {
     "use strict";
@@ -245557,7 +247622,7 @@ var init_directory_resolver = __esm({
     import_fs_extra = __toESM(__nccwpck_require__(61455), 1);
     import_url = __nccwpck_require__(87016);
     __filename = (0, import_url.fileURLToPath)("file:///");
-    __dirname = import_path.default.dirname(__filename);
+    __dirname2 = import_path.default.dirname(__filename);
   }
 });
 
@@ -246180,9 +248245,9 @@ async function saveVersionInfo(version2, binDir) {
 async function getPackageVersion() {
   try {
     const possiblePaths = [
-      import_path2.default.resolve(__dirname2, "..", "package.json"),
+      import_path2.default.resolve(__dirname3, "..", "package.json"),
       // When installed from npm: src/../package.json
-      import_path2.default.resolve(__dirname2, "..", "..", "package.json")
+      import_path2.default.resolve(__dirname3, "..", "..", "package.json")
       // In development: src/../../package.json
     ];
     for (const packageJsonPath of possiblePaths) {
@@ -246319,7 +248384,7 @@ async function downloadProbeBinary(version2) {
     throw sanitizeError(error2);
   }
 }
-var import_axios, import_fs_extra2, import_path2, import_crypto, import_util, import_child_process, import_tar, import_os2, import_url2, exec, REPO_OWNER, REPO_NAME, BINARY_NAME, __filename2, __dirname2, downloadLocks, LOCK_TIMEOUT_MS, LOCK_POLL_INTERVAL_MS, MAX_LOCK_WAIT_MS;
+var import_axios, import_fs_extra2, import_path2, import_crypto, import_util, import_child_process, import_tar, import_os2, import_url2, exec, REPO_OWNER, REPO_NAME, BINARY_NAME, __filename2, __dirname3, downloadLocks, LOCK_TIMEOUT_MS, LOCK_POLL_INTERVAL_MS, MAX_LOCK_WAIT_MS;
 var init_downloader = __esm({
   "src/downloader.js"() {
     "use strict";
@@ -246340,7 +248405,7 @@ var init_downloader = __esm({
     REPO_NAME = "probe";
     BINARY_NAME = "probe";
     __filename2 = (0, import_url2.fileURLToPath)("file:///");
-    __dirname2 = import_path2.default.dirname(__filename2);
+    __dirname3 = import_path2.default.dirname(__filename2);
     downloadLocks = /* @__PURE__ */ new Map();
     LOCK_TIMEOUT_MS = 5 * 60 * 1e3;
     LOCK_POLL_INTERVAL_MS = 1e3;
@@ -246362,7 +248427,7 @@ async function getBinaryPath(options = {}) {
   }
   const isWindows = process.platform === "win32";
   const binaryName = isWindows ? "probe.exe" : "probe-binary";
-  const localPackageBin = import_path3.default.resolve(__dirname3, "..", "bin");
+  const localPackageBin = import_path3.default.resolve(__dirname4, "..", "bin");
   const localBinaryPath = import_path3.default.join(localPackageBin, binaryName);
   if (import_fs_extra3.default.existsSync(localBinaryPath) && !forceDownload) {
     probeBinaryPath = localBinaryPath;
@@ -246411,7 +248476,7 @@ function escapeString(str) {
     return `'${str.replace(/'/g, "'\\''")}'`;
   }
 }
-var import_path3, import_fs_extra3, import_url3, __filename3, __dirname3, probeBinaryPath;
+var import_path3, import_fs_extra3, import_url3, __filename3, __dirname4, probeBinaryPath;
 var init_utils = __esm({
   "src/utils.js"() {
     "use strict";
@@ -246421,7 +248486,7 @@ var init_utils = __esm({
     init_downloader();
     init_directory_resolver();
     __filename3 = (0, import_url3.fileURLToPath)("file:///");
-    __dirname3 = import_path3.default.dirname(__filename3);
+    __dirname4 = import_path3.default.dirname(__filename3);
     probeBinaryPath = "";
   }
 });
@@ -264361,7 +266426,7 @@ var require_package2 = __commonJS({
     module2.exports = {
       name: "@aws-sdk/client-bedrock-runtime",
       description: "AWS SDK for JavaScript Bedrock Runtime Client for Node.js, Browser and React Native",
-      version: "3.998.0",
+      version: "3.999.0",
       scripts: {
         build: "concurrently 'yarn:build:types' 'yarn:build:es' && yarn build:cjs",
         "build:cjs": "node ../../scripts/compilation/inline client-bedrock-runtime",
@@ -264381,21 +266446,21 @@ var require_package2 = __commonJS({
       dependencies: {
         "@aws-crypto/sha256-browser": "5.2.0",
         "@aws-crypto/sha256-js": "5.2.0",
-        "@aws-sdk/core": "^3.973.14",
-        "@aws-sdk/credential-provider-node": "^3.972.13",
-        "@aws-sdk/eventstream-handler-node": "^3.972.8",
-        "@aws-sdk/middleware-eventstream": "^3.972.5",
-        "@aws-sdk/middleware-host-header": "^3.972.5",
-        "@aws-sdk/middleware-logger": "^3.972.5",
-        "@aws-sdk/middleware-recursion-detection": "^3.972.5",
-        "@aws-sdk/middleware-user-agent": "^3.972.14",
-        "@aws-sdk/middleware-websocket": "^3.972.9",
-        "@aws-sdk/region-config-resolver": "^3.972.5",
-        "@aws-sdk/token-providers": "3.998.0",
-        "@aws-sdk/types": "^3.973.3",
-        "@aws-sdk/util-endpoints": "^3.996.2",
-        "@aws-sdk/util-user-agent-browser": "^3.972.5",
-        "@aws-sdk/util-user-agent-node": "^3.972.13",
+        "@aws-sdk/core": "^3.973.15",
+        "@aws-sdk/credential-provider-node": "^3.972.14",
+        "@aws-sdk/eventstream-handler-node": "^3.972.9",
+        "@aws-sdk/middleware-eventstream": "^3.972.6",
+        "@aws-sdk/middleware-host-header": "^3.972.6",
+        "@aws-sdk/middleware-logger": "^3.972.6",
+        "@aws-sdk/middleware-recursion-detection": "^3.972.6",
+        "@aws-sdk/middleware-user-agent": "^3.972.15",
+        "@aws-sdk/middleware-websocket": "^3.972.10",
+        "@aws-sdk/region-config-resolver": "^3.972.6",
+        "@aws-sdk/token-providers": "3.999.0",
+        "@aws-sdk/types": "^3.973.4",
+        "@aws-sdk/util-endpoints": "^3.996.3",
+        "@aws-sdk/util-user-agent-browser": "^3.972.6",
+        "@aws-sdk/util-user-agent-node": "^3.973.0",
         "@smithy/config-resolver": "^4.4.9",
         "@smithy/core": "^3.23.6",
         "@smithy/eventstream-serde-browser": "^4.2.10",
@@ -264989,7 +267054,7 @@ var require_fromHttp = __commonJS({
     var client_1 = (init_client(), __toCommonJS(client_exports));
     var node_http_handler_1 = require_dist_cjs15();
     var property_provider_1 = require_dist_cjs24();
-    var promises_1 = tslib_1.__importDefault(__nccwpck_require__(91943));
+    var promises_1 = tslib_1.__importDefault(__nccwpck_require__(73836));
     var checkUrl_1 = require_checkUrl();
     var requestHelpers_1 = require_requestHelpers();
     var retry_wrapper_1 = require_retry_wrapper();
@@ -265142,7 +267207,7 @@ var init_package = __esm({
   "node_modules/@aws-sdk/nested-clients/package.json"() {
     package_default = {
       name: "@aws-sdk/nested-clients",
-      version: "3.996.2",
+      version: "3.996.3",
       description: "Nested clients for AWS SDK packages.",
       main: "./dist-cjs/index.js",
       module: "./dist-es/index.js",
@@ -265171,16 +267236,16 @@ var init_package = __esm({
       dependencies: {
         "@aws-crypto/sha256-browser": "5.2.0",
         "@aws-crypto/sha256-js": "5.2.0",
-        "@aws-sdk/core": "^3.973.14",
-        "@aws-sdk/middleware-host-header": "^3.972.5",
-        "@aws-sdk/middleware-logger": "^3.972.5",
-        "@aws-sdk/middleware-recursion-detection": "^3.972.5",
-        "@aws-sdk/middleware-user-agent": "^3.972.14",
-        "@aws-sdk/region-config-resolver": "^3.972.5",
-        "@aws-sdk/types": "^3.973.3",
-        "@aws-sdk/util-endpoints": "^3.996.2",
-        "@aws-sdk/util-user-agent-browser": "^3.972.5",
-        "@aws-sdk/util-user-agent-node": "^3.972.13",
+        "@aws-sdk/core": "^3.973.15",
+        "@aws-sdk/middleware-host-header": "^3.972.6",
+        "@aws-sdk/middleware-logger": "^3.972.6",
+        "@aws-sdk/middleware-recursion-detection": "^3.972.6",
+        "@aws-sdk/middleware-user-agent": "^3.972.15",
+        "@aws-sdk/region-config-resolver": "^3.972.6",
+        "@aws-sdk/types": "^3.973.4",
+        "@aws-sdk/util-endpoints": "^3.996.3",
+        "@aws-sdk/util-user-agent-browser": "^3.972.6",
+        "@aws-sdk/util-user-agent-node": "^3.973.0",
         "@smithy/config-resolver": "^4.4.9",
         "@smithy/core": "^3.23.6",
         "@smithy/fetch-http-handler": "^5.3.11",
@@ -265292,17 +267357,51 @@ var init_package = __esm({
 var require_dist_cjs51 = __commonJS({
   "node_modules/@aws-sdk/util-user-agent-node/dist-cjs/index.js"(exports2) {
     "use strict";
-    var os4 = __nccwpck_require__(70857);
-    var process2 = __nccwpck_require__(932);
+    var node_os = __nccwpck_require__(48161);
+    var node_process = __nccwpck_require__(1708);
+    var promises = __nccwpck_require__(73836);
+    var node_path = __nccwpck_require__(76760);
     var middlewareUserAgent = require_dist_cjs29();
     var getRuntimeUserAgentPair = () => {
       const runtimesToCheck = ["deno", "bun", "llrt"];
       for (const runtime of runtimesToCheck) {
-        if (process2.versions[runtime]) {
-          return [`md/${runtime}`, process2.versions[runtime]];
+        if (node_process.versions[runtime]) {
+          return [`md/${runtime}`, node_process.versions[runtime]];
         }
       }
-      return ["md/nodejs", process2.versions.node];
+      return ["md/nodejs", node_process.versions.node];
+    };
+    var getTypeScriptPackageJsonPath = (dirname6 = "") => {
+      let nodeModulesPath;
+      const normalizedPath = node_path.normalize(dirname6);
+      const parts = normalizedPath.split(node_path.sep);
+      const nodeModulesIndex = parts.indexOf("node_modules");
+      if (nodeModulesIndex !== -1) {
+        nodeModulesPath = parts.slice(0, nodeModulesIndex).join(node_path.sep);
+      } else {
+        nodeModulesPath = dirname6;
+      }
+      return node_path.join(nodeModulesPath, "node_modules", "typescript", "package.json");
+    };
+    var tscVersion;
+    var getTypeScriptUserAgentPair = async () => {
+      if (tscVersion === null) {
+        return void 0;
+      } else if (typeof tscVersion === "string") {
+        return ["md/tsc", tscVersion];
+      }
+      try {
+        const packageJson = await promises.readFile(getTypeScriptPackageJsonPath(__dirname), "utf-8");
+        const { version: version2 } = JSON.parse(packageJson);
+        if (typeof version2 !== "string") {
+          tscVersion = null;
+          return void 0;
+        }
+        tscVersion = version2;
+        return ["md/tsc", tscVersion];
+      } catch {
+        tscVersion = null;
+      }
     };
     var crtAvailability = {
       isCrtAvailable: false
@@ -265319,10 +267418,14 @@ var require_dist_cjs51 = __commonJS({
         const sections = [
           ["aws-sdk-js", clientVersion],
           ["ua", "2.1"],
-          [`os/${os4.platform()}`, os4.release()],
+          [`os/${node_os.platform()}`, node_os.release()],
           ["lang/js"],
           runtimeUserAgentPair
         ];
+        const typescriptUserAgentPair = await getTypeScriptUserAgentPair();
+        if (typescriptUserAgentPair) {
+          sections.push(typescriptUserAgentPair);
+        }
         const crtAvailable = isCrtAvailable();
         if (crtAvailable) {
           sections.push(crtAvailable);
@@ -265330,8 +267433,8 @@ var require_dist_cjs51 = __commonJS({
         if (serviceId) {
           sections.push([`api/${serviceId}`, clientVersion]);
         }
-        if (process2.env.AWS_EXECUTION_ENV) {
-          sections.push([`exec-env/${process2.env.AWS_EXECUTION_ENV}`]);
+        if (node_process.env.AWS_EXECUTION_ENV) {
+          sections.push([`exec-env/${node_process.env.AWS_EXECUTION_ENV}`]);
         }
         const appId = await config?.userAgentAppId?.();
         const resolvedUserAgent = appId ? [...sections, [`app/${appId}`]] : [...sections];
@@ -266405,7 +268508,7 @@ var require_dist_cjs56 = __commonJS({
     var httpAuthSchemes = (init_httpAuthSchemes2(), __toCommonJS(httpAuthSchemes_exports));
     var propertyProvider = require_dist_cjs24();
     var sharedIniFileLoader = require_dist_cjs42();
-    var fs10 = __nccwpck_require__(79896);
+    var node_fs = __nccwpck_require__(73024);
     var fromEnvSigningName = ({ logger: logger2, signingName } = {}) => async () => {
       logger2?.debug?.("@aws-sdk/token-providers - fromEnvSigningName");
       if (!signingName) {
@@ -266451,7 +268554,7 @@ var require_dist_cjs56 = __commonJS({
         throw new propertyProvider.TokenProviderError(`Value not present for '${key}' in SSO Token${forRefresh ? ". Cannot refresh" : ""}. ${REFRESH_MESSAGE}`, false);
       }
     };
-    var { writeFile: writeFile2 } = fs10.promises;
+    var { writeFile: writeFile2 } = node_fs.promises;
     var writeSSOTokenToFile = (id, ssoToken) => {
       const tokenFilepath = sharedIniFileLoader.getSSOTokenFilepath(id);
       const tokenString = JSON.stringify(ssoToken, null, 2);
@@ -269573,8 +271676,8 @@ var require_dist_cjs59 = __commonJS({
     "use strict";
     var sharedIniFileLoader = require_dist_cjs42();
     var propertyProvider = require_dist_cjs24();
-    var child_process = __nccwpck_require__(35317);
-    var util2 = __nccwpck_require__(39023);
+    var node_child_process = __nccwpck_require__(31421);
+    var node_util = __nccwpck_require__(57975);
     var client = (init_client(), __toCommonJS(client_exports));
     var getValidatedProcessCredentials = (profileName, data3, profiles) => {
       if (data3.Version !== 1) {
@@ -269610,7 +271713,7 @@ var require_dist_cjs59 = __commonJS({
       if (profiles[profileName]) {
         const credentialProcess = profile["credential_process"];
         if (credentialProcess !== void 0) {
-          const execPromise = util2.promisify(sharedIniFileLoader.externalDataInterceptor?.getTokenRecord?.().exec ?? child_process.exec);
+          const execPromise = node_util.promisify(sharedIniFileLoader.externalDataInterceptor?.getTokenRecord?.().exec ?? node_child_process.exec);
           try {
             const { stdout } = await execPromise(credentialProcess);
             let data3;
@@ -269724,7 +271827,7 @@ var require_fromTokenFile = __commonJS({
     var client_1 = (init_client(), __toCommonJS(client_exports));
     var property_provider_1 = require_dist_cjs24();
     var shared_ini_file_loader_1 = require_dist_cjs42();
-    var fs_1 = __nccwpck_require__(79896);
+    var node_fs_1 = __nccwpck_require__(73024);
     var fromWebToken_1 = require_fromWebToken();
     var ENV_TOKEN_FILE = "AWS_WEB_IDENTITY_TOKEN_FILE";
     var ENV_ROLE_ARN = "AWS_ROLE_ARN";
@@ -269741,7 +271844,7 @@ var require_fromTokenFile = __commonJS({
       }
       const credentials = await (0, fromWebToken_1.fromWebToken)({
         ...init,
-        webIdentityToken: shared_ini_file_loader_1.externalDataInterceptor?.getTokenRecord?.()[webIdentityTokenFile] ?? (0, fs_1.readFileSync)(webIdentityTokenFile, { encoding: "ascii" }),
+        webIdentityToken: shared_ini_file_loader_1.externalDataInterceptor?.getTokenRecord?.()[webIdentityTokenFile] ?? (0, node_fs_1.readFileSync)(webIdentityTokenFile, { encoding: "ascii" }),
         roleArn,
         roleSessionName
       })(awsIdentityProperties);
@@ -282616,13 +284719,13 @@ Capabilities:
 });
 
 // src/agent/xmlParsingUtils.js
-function removeThinkingTags(xmlString) {
+function removeThinkingTags(xmlString, validTools = DEFAULT_VALID_TOOLS) {
   let result = xmlString;
   result = result.replace(/<thinking>[\s\S]*?<\/thinking>/g, "");
   const thinkingIndex = result.indexOf("<thinking>");
   if (thinkingIndex !== -1) {
     const afterThinking = result.substring(thinkingIndex + "<thinking>".length);
-    const toolPattern = buildToolTagPattern(DEFAULT_VALID_TOOLS);
+    const toolPattern = buildToolTagPattern(validTools);
     const toolMatch = afterThinking.match(toolPattern);
     if (toolMatch) {
       const toolStart = thinkingIndex + "<thinking>".length + toolMatch.index;
@@ -282721,7 +284824,7 @@ function hasOtherToolTags(xmlString, validTools = []) {
 }
 function processXmlWithThinkingAndRecovery(xmlString, validTools = []) {
   const thinkingContent = extractThinkingContent(xmlString);
-  const cleanedXmlString = removeThinkingTags(xmlString);
+  const cleanedXmlString = removeThinkingTags(xmlString, validTools.length > 0 ? validTools : void 0);
   const recoveryResult = checkAttemptCompleteRecovery(cleanedXmlString, validTools);
   if (process.env.DEBUG === "1" && thinkingContent) {
     console.log(`[DEBUG] AI Thinking Process:
@@ -283671,31 +285774,33 @@ var init_fileTracker = __esm({
   }
 });
 
-// node_modules/balanced-match/dist/esm/index.js
-var balanced, maybeMatch, range2;
-var init_esm = __esm({
-  "node_modules/balanced-match/dist/esm/index.js"() {
-    balanced = (a5, b5, str) => {
-      const ma = a5 instanceof RegExp ? maybeMatch(a5, str) : a5;
-      const mb = b5 instanceof RegExp ? maybeMatch(b5, str) : b5;
-      const r5 = ma !== null && mb != null && range2(ma, mb, str);
+// node_modules/balanced-match/index.js
+var require_balanced_match = __commonJS({
+  "node_modules/balanced-match/index.js"(exports2, module2) {
+    "use strict";
+    module2.exports = balanced;
+    function balanced(a5, b5, str) {
+      if (a5 instanceof RegExp) a5 = maybeMatch(a5, str);
+      if (b5 instanceof RegExp) b5 = maybeMatch(b5, str);
+      var r5 = range2(a5, b5, str);
       return r5 && {
         start: r5[0],
         end: r5[1],
         pre: str.slice(0, r5[0]),
-        body: str.slice(r5[0] + ma.length, r5[1]),
-        post: str.slice(r5[1] + mb.length)
+        body: str.slice(r5[0] + a5.length, r5[1]),
+        post: str.slice(r5[1] + b5.length)
       };
-    };
-    maybeMatch = (reg, str) => {
-      const m5 = str.match(reg);
+    }
+    function maybeMatch(reg, str) {
+      var m5 = str.match(reg);
       return m5 ? m5[0] : null;
-    };
-    range2 = (a5, b5, str) => {
-      let begs, beg, left, right = void 0, result;
-      let ai = str.indexOf(a5);
-      let bi = str.indexOf(b5, ai + 1);
-      let i5 = ai;
+    }
+    balanced.range = range2;
+    function range2(a5, b5, str) {
+      var begs, beg, left, right, result;
+      var ai = str.indexOf(a5);
+      var bi = str.indexOf(b5, ai + 1);
+      var i5 = ai;
       if (ai >= 0 && bi > 0) {
         if (a5 === b5) {
           return [ai, bi];
@@ -283703,16 +285808,14 @@ var init_esm = __esm({
         begs = [];
         left = str.length;
         while (i5 >= 0 && !result) {
-          if (i5 === ai) {
+          if (i5 == ai) {
             begs.push(i5);
             ai = str.indexOf(a5, i5 + 1);
-          } else if (begs.length === 1) {
-            const r5 = begs.pop();
-            if (r5 !== void 0)
-              result = [r5, bi];
+          } else if (begs.length == 1) {
+            result = [begs.pop(), bi];
           } else {
             beg = begs.pop();
-            if (beg !== void 0 && beg < left) {
+            if (beg < left) {
               left = beg;
               right = bi;
             }
@@ -283720,179 +285823,163 @@ var init_esm = __esm({
           }
           i5 = ai < bi && ai >= 0 ? ai : bi;
         }
-        if (begs.length && right !== void 0) {
+        if (begs.length) {
           result = [left, right];
         }
       }
       return result;
-    };
+    }
   }
 });
 
-// node_modules/brace-expansion/dist/esm/index.js
-function numeric(str) {
-  return !isNaN(str) ? parseInt(str, 10) : str.charCodeAt(0);
-}
-function escapeBraces(str) {
-  return str.replace(slashPattern, escSlash).replace(openPattern, escOpen).replace(closePattern, escClose).replace(commaPattern, escComma).replace(periodPattern, escPeriod);
-}
-function unescapeBraces(str) {
-  return str.replace(escSlashPattern, "\\").replace(escOpenPattern, "{").replace(escClosePattern, "}").replace(escCommaPattern, ",").replace(escPeriodPattern, ".");
-}
-function parseCommaParts(str) {
-  if (!str) {
-    return [""];
-  }
-  const parts = [];
-  const m5 = balanced("{", "}", str);
-  if (!m5) {
-    return str.split(",");
-  }
-  const { pre, body, post } = m5;
-  const p5 = pre.split(",");
-  p5[p5.length - 1] += "{" + body + "}";
-  const postParts = parseCommaParts(post);
-  if (post.length) {
-    ;
-    p5[p5.length - 1] += postParts.shift();
-    p5.push.apply(p5, postParts);
-  }
-  parts.push.apply(parts, p5);
-  return parts;
-}
-function expand(str, options = {}) {
-  if (!str) {
-    return [];
-  }
-  const { max = EXPANSION_MAX } = options;
-  if (str.slice(0, 2) === "{}") {
-    str = "\\{\\}" + str.slice(2);
-  }
-  return expand_(escapeBraces(str), max, true).map(unescapeBraces);
-}
-function embrace(str) {
-  return "{" + str + "}";
-}
-function isPadded(el) {
-  return /^-?0\d/.test(el);
-}
-function lte(i5, y2) {
-  return i5 <= y2;
-}
-function gte(i5, y2) {
-  return i5 >= y2;
-}
-function expand_(str, max, isTop) {
-  const expansions = [];
-  const m5 = balanced("{", "}", str);
-  if (!m5)
-    return [str];
-  const pre = m5.pre;
-  const post = m5.post.length ? expand_(m5.post, max, false) : [""];
-  if (/\$$/.test(m5.pre)) {
-    for (let k5 = 0; k5 < post.length && k5 < max; k5++) {
-      const expansion = pre + "{" + m5.body + "}" + post[k5];
-      expansions.push(expansion);
+// node_modules/brace-expansion/index.js
+var require_brace_expansion = __commonJS({
+  "node_modules/brace-expansion/index.js"(exports2, module2) {
+    var balanced = require_balanced_match();
+    module2.exports = expandTop;
+    var escSlash = "\0SLASH" + Math.random() + "\0";
+    var escOpen = "\0OPEN" + Math.random() + "\0";
+    var escClose = "\0CLOSE" + Math.random() + "\0";
+    var escComma = "\0COMMA" + Math.random() + "\0";
+    var escPeriod = "\0PERIOD" + Math.random() + "\0";
+    function numeric(str) {
+      return parseInt(str, 10) == str ? parseInt(str, 10) : str.charCodeAt(0);
+    }
+    function escapeBraces(str) {
+      return str.split("\\\\").join(escSlash).split("\\{").join(escOpen).split("\\}").join(escClose).split("\\,").join(escComma).split("\\.").join(escPeriod);
+    }
+    function unescapeBraces(str) {
+      return str.split(escSlash).join("\\").split(escOpen).join("{").split(escClose).join("}").split(escComma).join(",").split(escPeriod).join(".");
+    }
+    function parseCommaParts(str) {
+      if (!str)
+        return [""];
+      var parts = [];
+      var m5 = balanced("{", "}", str);
+      if (!m5)
+        return str.split(",");
+      var pre = m5.pre;
+      var body = m5.body;
+      var post = m5.post;
+      var p5 = pre.split(",");
+      p5[p5.length - 1] += "{" + body + "}";
+      var postParts = parseCommaParts(post);
+      if (post.length) {
+        p5[p5.length - 1] += postParts.shift();
+        p5.push.apply(p5, postParts);
+      }
+      parts.push.apply(parts, p5);
+      return parts;
+    }
+    function expandTop(str) {
+      if (!str)
+        return [];
+      if (str.substr(0, 2) === "{}") {
+        str = "\\{\\}" + str.substr(2);
+      }
+      return expand2(escapeBraces(str), true).map(unescapeBraces);
     }
-  } else {
-    const isNumericSequence = /^-?\d+\.\.-?\d+(?:\.\.-?\d+)?$/.test(m5.body);
-    const isAlphaSequence = /^[a-zA-Z]\.\.[a-zA-Z](?:\.\.-?\d+)?$/.test(m5.body);
-    const isSequence = isNumericSequence || isAlphaSequence;
-    const isOptions = m5.body.indexOf(",") >= 0;
-    if (!isSequence && !isOptions) {
-      if (m5.post.match(/,(?!,).*\}/)) {
-        str = m5.pre + "{" + m5.body + escClose + m5.post;
-        return expand_(str, max, true);
-      }
-      return [str];
-    }
-    let n5;
-    if (isSequence) {
-      n5 = m5.body.split(/\.\./);
-    } else {
-      n5 = parseCommaParts(m5.body);
-      if (n5.length === 1 && n5[0] !== void 0) {
-        n5 = expand_(n5[0], max, false).map(embrace);
-        if (n5.length === 1) {
-          return post.map((p5) => m5.pre + n5[0] + p5);
-        }
-      }
-    }
-    let N;
-    if (isSequence && n5[0] !== void 0 && n5[1] !== void 0) {
-      const x5 = numeric(n5[0]);
-      const y2 = numeric(n5[1]);
-      const width = Math.max(n5[0].length, n5[1].length);
-      let incr = n5.length === 3 && n5[2] !== void 0 ? Math.abs(numeric(n5[2])) : 1;
-      let test = lte;
-      const reverse = y2 < x5;
-      if (reverse) {
-        incr *= -1;
-        test = gte;
-      }
-      const pad = n5.some(isPadded);
-      N = [];
-      for (let i5 = x5; test(i5, y2); i5 += incr) {
-        let c5;
-        if (isAlphaSequence) {
-          c5 = String.fromCharCode(i5);
-          if (c5 === "\\") {
-            c5 = "";
+    function embrace(str) {
+      return "{" + str + "}";
+    }
+    function isPadded(el) {
+      return /^-?0\d/.test(el);
+    }
+    function lte(i5, y2) {
+      return i5 <= y2;
+    }
+    function gte(i5, y2) {
+      return i5 >= y2;
+    }
+    function expand2(str, isTop) {
+      var expansions = [];
+      var m5 = balanced("{", "}", str);
+      if (!m5) return [str];
+      var pre = m5.pre;
+      var post = m5.post.length ? expand2(m5.post, false) : [""];
+      if (/\$$/.test(m5.pre)) {
+        for (var k5 = 0; k5 < post.length; k5++) {
+          var expansion = pre + "{" + m5.body + "}" + post[k5];
+          expansions.push(expansion);
+        }
+      } else {
+        var isNumericSequence = /^-?\d+\.\.-?\d+(?:\.\.-?\d+)?$/.test(m5.body);
+        var isAlphaSequence = /^[a-zA-Z]\.\.[a-zA-Z](?:\.\.-?\d+)?$/.test(m5.body);
+        var isSequence = isNumericSequence || isAlphaSequence;
+        var isOptions = m5.body.indexOf(",") >= 0;
+        if (!isSequence && !isOptions) {
+          if (m5.post.match(/,(?!,).*\}/)) {
+            str = m5.pre + "{" + m5.body + escClose + m5.post;
+            return expand2(str);
           }
+          return [str];
+        }
+        var n5;
+        if (isSequence) {
+          n5 = m5.body.split(/\.\./);
         } else {
-          c5 = String(i5);
-          if (pad) {
-            const need = width - c5.length;
-            if (need > 0) {
-              const z2 = new Array(need + 1).join("0");
-              if (i5 < 0) {
-                c5 = "-" + z2 + c5.slice(1);
-              } else {
-                c5 = z2 + c5;
+          n5 = parseCommaParts(m5.body);
+          if (n5.length === 1) {
+            n5 = expand2(n5[0], false).map(embrace);
+            if (n5.length === 1) {
+              return post.map(function(p5) {
+                return m5.pre + n5[0] + p5;
+              });
+            }
+          }
+        }
+        var N;
+        if (isSequence) {
+          var x5 = numeric(n5[0]);
+          var y2 = numeric(n5[1]);
+          var width = Math.max(n5[0].length, n5[1].length);
+          var incr = n5.length == 3 ? Math.abs(numeric(n5[2])) : 1;
+          var test = lte;
+          var reverse = y2 < x5;
+          if (reverse) {
+            incr *= -1;
+            test = gte;
+          }
+          var pad = n5.some(isPadded);
+          N = [];
+          for (var i5 = x5; test(i5, y2); i5 += incr) {
+            var c5;
+            if (isAlphaSequence) {
+              c5 = String.fromCharCode(i5);
+              if (c5 === "\\")
+                c5 = "";
+            } else {
+              c5 = String(i5);
+              if (pad) {
+                var need = width - c5.length;
+                if (need > 0) {
+                  var z2 = new Array(need + 1).join("0");
+                  if (i5 < 0)
+                    c5 = "-" + z2 + c5.slice(1);
+                  else
+                    c5 = z2 + c5;
+                }
               }
             }
+            N.push(c5);
+          }
+        } else {
+          N = [];
+          for (var j5 = 0; j5 < n5.length; j5++) {
+            N.push.apply(N, expand2(n5[j5], false));
           }
         }
-        N.push(c5);
-      }
-    } else {
-      N = [];
-      for (let j5 = 0; j5 < n5.length; j5++) {
-        N.push.apply(N, expand_(n5[j5], max, false));
-      }
-    }
-    for (let j5 = 0; j5 < N.length; j5++) {
-      for (let k5 = 0; k5 < post.length && expansions.length < max; k5++) {
-        const expansion = pre + N[j5] + post[k5];
-        if (!isTop || isSequence || expansion) {
-          expansions.push(expansion);
+        for (var j5 = 0; j5 < N.length; j5++) {
+          for (var k5 = 0; k5 < post.length; k5++) {
+            var expansion = pre + N[j5] + post[k5];
+            if (!isTop || isSequence || expansion)
+              expansions.push(expansion);
+          }
         }
       }
+      return expansions;
     }
   }
-  return expansions;
-}
-var escSlash, escOpen, escClose, escComma, escPeriod, escSlashPattern, escOpenPattern, escClosePattern, escCommaPattern, escPeriodPattern, slashPattern, openPattern, closePattern, commaPattern, periodPattern, EXPANSION_MAX;
-var init_esm2 = __esm({
-  "node_modules/brace-expansion/dist/esm/index.js"() {
-    init_esm();
-    escSlash = "\0SLASH" + Math.random() + "\0";
-    escOpen = "\0OPEN" + Math.random() + "\0";
-    escClose = "\0CLOSE" + Math.random() + "\0";
-    escComma = "\0COMMA" + Math.random() + "\0";
-    escPeriod = "\0PERIOD" + Math.random() + "\0";
-    escSlashPattern = new RegExp(escSlash, "g");
-    escOpenPattern = new RegExp(escOpen, "g");
-    escClosePattern = new RegExp(escClose, "g");
-    escCommaPattern = new RegExp(escComma, "g");
-    escPeriodPattern = new RegExp(escPeriod, "g");
-    slashPattern = /\\\\/g;
-    openPattern = /\\{/g;
-    closePattern = /\\}/g;
-    commaPattern = /\\,/g;
-    periodPattern = /\\./g;
-    EXPANSION_MAX = 1e5;
-  }
 });
 
 // node_modules/minimatch/dist/esm/assert-valid-pattern.js
@@ -284664,10 +286751,10 @@ var init_escape = __esm({
 });
 
 // node_modules/minimatch/dist/esm/index.js
-var minimatch, starDotExtRE, starDotExtTest, starDotExtTestDot, starDotExtTestNocase, starDotExtTestNocaseDot, starDotStarRE, starDotStarTest, starDotStarTestDot, dotStarRE, dotStarTest, starRE, starTest, starTestDot, qmarksRE, qmarksTestNocase, qmarksTestNocaseDot, qmarksTestDot, qmarksTest, qmarksTestNoExt, qmarksTestNoExtDot, defaultPlatform, path5, sep2, GLOBSTAR, qmark2, star2, twoStarDot, twoStarNoDot, filter, ext, defaults, braceExpand, makeRe, match, globMagic, regExpEscape2, Minimatch;
-var init_esm3 = __esm({
+var import_brace_expansion, minimatch, starDotExtRE, starDotExtTest, starDotExtTestDot, starDotExtTestNocase, starDotExtTestNocaseDot, starDotStarRE, starDotStarTest, starDotStarTestDot, dotStarRE, dotStarTest, starRE, starTest, starTestDot, qmarksRE, qmarksTestNocase, qmarksTestNocaseDot, qmarksTestDot, qmarksTest, qmarksTestNoExt, qmarksTestNoExtDot, defaultPlatform, path5, sep2, GLOBSTAR, qmark2, star2, twoStarDot, twoStarNoDot, filter, ext, defaults, braceExpand, makeRe, match, globMagic, regExpEscape2, Minimatch;
+var init_esm = __esm({
   "node_modules/minimatch/dist/esm/index.js"() {
-    init_esm2();
+    import_brace_expansion = __toESM(require_brace_expansion(), 1);
     init_assert_valid_pattern();
     init_ast();
     init_escape();
@@ -284790,7 +286877,7 @@ var init_esm3 = __esm({
       if (options.nobrace || !/\{(?:(?!\{).)*\}/.test(pattern)) {
         return [pattern];
       }
-      return expand(pattern);
+      return (0, import_brace_expansion.default)(pattern);
     };
     minimatch.braceExpand = braceExpand;
     makeRe = (pattern, options = {}) => new Minimatch(pattern, options).makeRe();
@@ -285466,7 +287553,7 @@ var init_esm3 = __esm({
 
 // node_modules/path-scurry/node_modules/lru-cache/dist/esm/index.js
 var perf, warned, PROCESS, emitWarning, AC, AS, shouldWarn, TYPE, isPosInt, getUintArray, ZeroArray, Stack, LRUCache;
-var init_esm4 = __esm({
+var init_esm2 = __esm({
   "node_modules/path-scurry/node_modules/lru-cache/dist/esm/index.js"() {
     perf = typeof performance === "object" && performance && typeof performance.now === "function" ? performance : Date;
     warned = /* @__PURE__ */ new Set();
@@ -286840,7 +288927,7 @@ var init_esm4 = __esm({
 
 // node_modules/minipass/dist/esm/index.js
 var import_node_events, import_node_stream, import_node_string_decoder, proc, isStream, isReadable, isWritable, EOF, MAYBE_EMIT_END, EMITTED_END, EMITTING_END, EMITTED_ERROR, CLOSED, READ, FLUSH, FLUSHCHUNK, ENCODING, DECODER, FLOWING, PAUSED, RESUME, BUFFER, PIPES, BUFFERLENGTH, BUFFERPUSH, BUFFERSHIFT, OBJECTMODE, DESTROYED, ERROR, EMITDATA, EMITEND, EMITEND2, ASYNC, ABORT, ABORTED, SIGNAL, DATALISTENERS, DISCARDED, defer, nodefer, isEndish, isArrayBufferLike, isArrayBufferView, Pipe, PipeProxyErrors, isObjectModeOptions, isEncodingOptions, Minipass;
-var init_esm5 = __esm({
+var init_esm3 = __esm({
   "node_modules/minipass/dist/esm/index.js"() {
     import_node_events = __nccwpck_require__(78474);
     import_node_stream = __toESM(__nccwpck_require__(57075), 1);
@@ -287727,15 +289814,15 @@ var init_esm5 = __esm({
 
 // node_modules/path-scurry/dist/esm/index.js
 var import_node_path, import_node_url, import_fs6, actualFS, import_promises, realpathSync2, defaultFS, fsFromOption, uncDriveRegexp, uncToDrive, eitherSep, UNKNOWN, IFIFO, IFCHR, IFDIR, IFBLK, IFREG, IFLNK, IFSOCK, IFMT, IFMT_UNKNOWN, READDIR_CALLED, LSTAT_CALLED, ENOTDIR, ENOENT, ENOREADLINK, ENOREALPATH, ENOCHILD, TYPEMASK, entToType, normalizeCache, normalize, normalizeNocaseCache, normalizeNocase, ResolveCache, ChildrenCache, setAsCwd, PathBase, PathWin32, PathPosix, PathScurryBase, PathScurryWin32, PathScurryPosix, PathScurryDarwin, Path, PathScurry;
-var init_esm6 = __esm({
+var init_esm4 = __esm({
   "node_modules/path-scurry/dist/esm/index.js"() {
-    init_esm4();
+    init_esm2();
     import_node_path = __nccwpck_require__(76760);
     import_node_url = __nccwpck_require__(73136);
     import_fs6 = __nccwpck_require__(79896);
     actualFS = __toESM(__nccwpck_require__(73024), 1);
     import_promises = __nccwpck_require__(73836);
-    init_esm5();
+    init_esm3();
     realpathSync2 = import_fs6.realpathSync.native;
     defaultFS = {
       lstatSync: import_fs6.lstatSync,
@@ -289465,7 +291552,7 @@ var init_esm6 = __esm({
 var isPatternList, isGlobList, Pattern;
 var init_pattern = __esm({
   "node_modules/glob/dist/esm/pattern.js"() {
-    init_esm3();
+    init_esm();
     isPatternList = (pl) => pl.length >= 1;
     isGlobList = (gl) => gl.length >= 1;
     Pattern = class _Pattern {
@@ -289636,7 +291723,7 @@ var init_pattern = __esm({
 var defaultPlatform2, Ignore;
 var init_ignore = __esm({
   "node_modules/glob/dist/esm/ignore.js"() {
-    init_esm3();
+    init_esm();
     init_pattern();
     defaultPlatform2 = typeof process === "object" && process && typeof process.platform === "string" ? process.platform : "linux";
     Ignore = class {
@@ -289730,7 +291817,7 @@ var init_ignore = __esm({
 var HasWalkedCache, MatchRecord, SubWalks, Processor;
 var init_processor = __esm({
   "node_modules/glob/dist/esm/processor.js"() {
-    init_esm3();
+    init_esm();
     HasWalkedCache = class _HasWalkedCache {
       store;
       constructor(store = /* @__PURE__ */ new Map()) {
@@ -289957,7 +292044,7 @@ var init_processor = __esm({
 var makeIgnore, GlobUtil, GlobWalker, GlobStream;
 var init_walker = __esm({
   "node_modules/glob/dist/esm/walker.js"() {
-    init_esm5();
+    init_esm3();
     init_ignore();
     init_processor();
     makeIgnore = (ignore2, opts) => typeof ignore2 === "string" ? new Ignore([ignore2], opts) : Array.isArray(ignore2) ? new Ignore(ignore2, opts) : ignore2;
@@ -290292,9 +292379,9 @@ var init_walker = __esm({
 var import_node_url2, defaultPlatform3, Glob;
 var init_glob = __esm({
   "node_modules/glob/dist/esm/glob.js"() {
-    init_esm3();
+    init_esm();
     import_node_url2 = __nccwpck_require__(73136);
-    init_esm6();
+    init_esm4();
     init_pattern();
     init_walker();
     defaultPlatform3 = typeof process === "object" && process && typeof process.platform === "string" ? process.platform : "linux";
@@ -290502,7 +292589,7 @@ var init_glob = __esm({
 var hasMagic;
 var init_has_magic = __esm({
   "node_modules/glob/dist/esm/has-magic.js"() {
-    init_esm3();
+    init_esm();
     hasMagic = (pattern, options = {}) => {
       if (!Array.isArray(pattern)) {
         pattern = [pattern];
@@ -290536,12 +292623,12 @@ function globIterate(pattern, options = {}) {
   return new Glob(pattern, options).iterate();
 }
 var streamSync, stream, iterateSync, iterate, sync, glob;
-var init_esm7 = __esm({
+var init_esm5 = __esm({
   "node_modules/glob/dist/esm/index.js"() {
-    init_esm3();
+    init_esm();
     init_glob();
     init_has_magic();
-    init_esm3();
+    init_esm();
     init_glob();
     init_has_magic();
     init_ignore();
@@ -290690,7 +292777,7 @@ var init_probeTool = __esm({
     import_fs7 = __toESM(__nccwpck_require__(79896), 1);
     import_fs8 = __nccwpck_require__(79896);
     import_path8 = __toESM(__nccwpck_require__(16928), 1);
-    init_esm7();
+    init_esm5();
     init_symlink_utils();
     toolCallEmitter = new import_events.EventEmitter();
     activeToolExecutions = /* @__PURE__ */ new Map();
@@ -296101,23 +298188,23 @@ var init_regexp_parser = __esm({
         return ASSERT_NEVER_REACH_HERE();
       }
       quantifier(isBacktracking = false) {
-        let range3 = void 0;
+        let range2 = void 0;
         const begin = this.idx;
         switch (this.popChar()) {
           case "*":
-            range3 = {
+            range2 = {
               atLeast: 0,
               atMost: Infinity
             };
             break;
           case "+":
-            range3 = {
+            range2 = {
               atLeast: 1,
               atMost: Infinity
             };
             break;
           case "?":
-            range3 = {
+            range2 = {
               atLeast: 0,
               atMost: 1
             };
@@ -296126,7 +298213,7 @@ var init_regexp_parser = __esm({
             const atLeast = this.integerIncludingZero();
             switch (this.popChar()) {
               case "}":
-                range3 = {
+                range2 = {
                   atLeast,
                   atMost: atLeast
                 };
@@ -296135,12 +298222,12 @@ var init_regexp_parser = __esm({
                 let atMost;
                 if (this.isDigit()) {
                   atMost = this.integerIncludingZero();
-                  range3 = {
+                  range2 = {
                     atLeast,
                     atMost
                   };
                 } else {
-                  range3 = {
+                  range2 = {
                     atLeast,
                     atMost: Infinity
                   };
@@ -296148,25 +298235,25 @@ var init_regexp_parser = __esm({
                 this.consumeChar("}");
                 break;
             }
-            if (isBacktracking === true && range3 === void 0) {
+            if (isBacktracking === true && range2 === void 0) {
               return void 0;
             }
-            ASSERT_EXISTS(range3);
+            ASSERT_EXISTS(range2);
             break;
         }
-        if (isBacktracking === true && range3 === void 0) {
+        if (isBacktracking === true && range2 === void 0) {
           return void 0;
         }
-        if (ASSERT_EXISTS(range3)) {
+        if (ASSERT_EXISTS(range2)) {
           if (this.peekChar(0) === "?") {
             this.consumeChar("?");
-            range3.greedy = false;
+            range2.greedy = false;
           } else {
-            range3.greedy = true;
+            range2.greedy = true;
           }
-          range3.type = "Quantifier";
-          range3.loc = this.loc(begin);
-          return range3;
+          range2.type = "Quantifier";
+          range2.loc = this.loc(begin);
+          return range2;
         }
       }
       atom() {
@@ -296868,18 +298955,18 @@ function firstCharOptimizedIndices(ast, result, ignoreCase) {
               if (typeof code === "number") {
                 addOptimizedIdxToResult(code, result, ignoreCase);
               } else {
-                const range3 = code;
+                const range2 = code;
                 if (ignoreCase === true) {
-                  for (let rangeCode = range3.from; rangeCode <= range3.to; rangeCode++) {
+                  for (let rangeCode = range2.from; rangeCode <= range2.to; rangeCode++) {
                     addOptimizedIdxToResult(rangeCode, result, ignoreCase);
                   }
                 } else {
-                  for (let rangeCode = range3.from; rangeCode <= range3.to && rangeCode < minOptimizationVal; rangeCode++) {
+                  for (let rangeCode = range2.from; rangeCode <= range2.to && rangeCode < minOptimizationVal; rangeCode++) {
                     addOptimizedIdxToResult(rangeCode, result, ignoreCase);
                   }
-                  if (range3.to >= minOptimizationVal) {
-                    const minUnOptVal = range3.from >= minOptimizationVal ? range3.from : minOptimizationVal;
-                    const maxUnOptVal = range3.to;
+                  if (range2.to >= minOptimizationVal) {
+                    const minUnOptVal = range2.from >= minOptimizationVal ? range2.from : minOptimizationVal;
+                    const maxUnOptVal = range2.to;
                     const minOptIdx = charCodeToOptimizedIndex(minUnOptVal);
                     const maxOptIdx = charCodeToOptimizedIndex(maxUnOptVal);
                     for (let currOptIdx = minOptIdx; currOptIdx <= maxOptIdx; currOptIdx++) {
@@ -296940,8 +299027,8 @@ function findCode(setNode, targetCharCodes) {
     if (typeof codeOrRange === "number") {
       return includes_default(targetCharCodes, codeOrRange);
     } else {
-      const range3 = codeOrRange;
-      return find_default(targetCharCodes, (targetCode) => range3.from <= targetCode && targetCode <= range3.to) !== void 0;
+      const range2 = codeOrRange;
+      return find_default(targetCharCodes, (targetCode) => range2.from <= targetCode && targetCode <= range2.to) !== void 0;
     }
   });
 }
@@ -314846,8 +316933,8 @@ var require_createRange = __commonJS({
 var require_range = __commonJS({
   "node_modules/lodash/range.js"(exports2, module2) {
     var createRange = require_createRange();
-    var range3 = createRange();
-    module2.exports = range3;
+    var range2 = createRange();
+    module2.exports = range2;
   }
 });
 
@@ -329700,7 +331787,7 @@ function parseEnabledServers(config) {
   }
   return servers;
 }
-var import_fs9, import_path9, import_os3, import_url4, __filename4, __dirname4, DEFAULT_TIMEOUT, MAX_TIMEOUT, DEFAULT_CONFIG;
+var import_fs9, import_path9, import_os3, import_url4, __filename4, __dirname5, DEFAULT_TIMEOUT, MAX_TIMEOUT, DEFAULT_CONFIG;
 var init_config = __esm({
   "src/agent/mcp/config.js"() {
     "use strict";
@@ -329709,7 +331796,7 @@ var init_config = __esm({
     import_os3 = __nccwpck_require__(70857);
     import_url4 = __nccwpck_require__(87016);
     __filename4 = (0, import_url4.fileURLToPath)("file:///");
-    __dirname4 = (0, import_path9.dirname)(__filename4);
+    __dirname5 = (0, import_path9.dirname)(__filename4);
     DEFAULT_TIMEOUT = 3e4;
     MAX_TIMEOUT = (() => {
       if (process.env.MCP_MAX_TIMEOUT) {
@@ -329723,7 +331810,7 @@ var init_config = __esm({
         // Example probe server configuration
         "probe-local": {
           command: "node",
-          args: [(0, import_path9.join)(__dirname4, "../../../examples/chat/mcpServer.js")],
+          args: [(0, import_path9.join)(__dirname5, "../../../examples/chat/mcpServer.js")],
           transport: "stdio",
           enabled: false
         },
@@ -335307,7 +337394,7 @@ var require_compose_scalar = __commonJS({
     var resolveBlockScalar = require_resolve_block_scalar();
     var resolveFlowScalar = require_resolve_flow_scalar();
     function composeScalar(ctx, token, tagToken, onError) {
-      const { value, type, comment, range: range3 } = token.type === "block-scalar" ? resolveBlockScalar.resolveBlockScalar(ctx, token, onError) : resolveFlowScalar.resolveFlowScalar(token, ctx.options.strict, onError);
+      const { value, type, comment, range: range2 } = token.type === "block-scalar" ? resolveBlockScalar.resolveBlockScalar(ctx, token, onError) : resolveFlowScalar.resolveFlowScalar(token, ctx.options.strict, onError);
       const tagName = tagToken ? ctx.directives.tagName(tagToken.source, (msg) => onError(tagToken, "TAG_RESOLVE_FAILED", msg)) : null;
       let tag2;
       if (ctx.options.stringKeys && ctx.atKey) {
@@ -335327,7 +337414,7 @@ var require_compose_scalar = __commonJS({
         onError(tagToken ?? token, "TAG_RESOLVE_FAILED", msg);
         scalar = new Scalar.Scalar(value);
       }
-      scalar.range = range3;
+      scalar.range = range2;
       scalar.source = value;
       if (type)
         scalar.type = type;
@@ -351581,7 +353668,7 @@ var init_executePlan = __esm({
     init_query();
     init_extract();
     init_delegate();
-    init_esm7();
+    init_esm5();
     init_bash();
     RAW_OUTPUT_START = "<<<RAW_OUTPUT>>>";
     RAW_OUTPUT_END = "<<<END_RAW_OUTPUT>>>";
@@ -394863,7 +396950,7 @@ module.exports = /*#__PURE__*/JSON.parse('{"100":"Continue","101":"Switching Pro
 /***/ ((module) => {
 
 "use strict";
-module.exports = /*#__PURE__*/JSON.parse('{"name":"@probelabs/visor","version":"0.1.146","main":"dist/index.js","bin":{"visor":"./dist/index.js"},"exports":{".":{"require":"./dist/index.js","import":"./dist/index.js"},"./sdk":{"types":"./dist/sdk/sdk.d.ts","import":"./dist/sdk/sdk.mjs","require":"./dist/sdk/sdk.js"},"./cli":{"require":"./dist/index.js"}},"files":["dist/","defaults/","action.yml","README.md","LICENSE"],"publishConfig":{"access":"public","registry":"https://registry.npmjs.org/"},"scripts":{"build:cli":"ncc build src/index.ts -o dist && cp -r defaults dist/ && cp -r output dist/ && cp -r docs dist/ && cp -r examples dist/ && cp -r src/debug-visualizer/ui dist/debug-visualizer/ && node scripts/inject-version.js && echo \'#!/usr/bin/env node\' | cat - dist/index.js > temp && mv temp dist/index.js && chmod +x dist/index.js","build:sdk":"tsup src/sdk.ts --dts --sourcemap --format esm,cjs --out-dir dist/sdk","build":"./scripts/build-oss.sh","build:ee":"npm run build:cli && npm run build:sdk","test":"jest && npm run test:yaml","test:unit":"jest","prepublishOnly":"npm run build","test:watch":"jest --watch","test:coverage":"jest --coverage","test:ee":"jest --testPathPatterns=\'tests/ee\' --testPathIgnorePatterns=\'/node_modules/\' --no-coverage","test:manual:bash":"RUN_MANUAL_TESTS=true jest tests/manual/bash-config-manual.test.ts","lint":"eslint src tests --ext .ts","lint:fix":"eslint src tests --ext .ts --fix","format":"prettier --write src tests","format:check":"prettier --check src tests","clean":"","clean:traces":"node scripts/clean-traces.js","prebuild":"npm run clean && node scripts/generate-config-schema.js","pretest":"npm run clean:traces && node scripts/generate-config-schema.js && npm run build:cli","pretest:unit":"npm run clean:traces && node scripts/generate-config-schema.js && npm run build:cli","test:with-build":"npm run build:cli && jest","test:yaml":"node dist/index.js test --progress compact","test:yaml:parallel":"node dist/index.js test --progress compact --max-parallel 4","prepare":"husky","pre-commit":"lint-staged","deploy:site":"cd site && npx wrangler pages deploy . --project-name=visor-site --commit-dirty=true","deploy:worker":"npx wrangler deploy","deploy":"npm run deploy:site && npm run deploy:worker","publish:ee":"./scripts/publish-ee.sh","release":"./scripts/release.sh","release:patch":"./scripts/release.sh patch","release:minor":"./scripts/release.sh minor","release:major":"./scripts/release.sh major","release:prerelease":"./scripts/release.sh prerelease","docs:validate":"node scripts/validate-readme-links.js","workshop:setup":"npm install -D reveal-md@6.1.2","workshop:serve":"cd workshop && reveal-md slides.md -w","workshop:export":"reveal-md workshop/slides.md --static workshop/build","workshop:pdf":"reveal-md workshop/slides.md --print workshop/Visor-Workshop.pdf --print-size letter","workshop:pdf:ci":"reveal-md workshop/slides.md --print workshop/Visor-Workshop.pdf --print-size letter --puppeteer-launch-args=\\"--no-sandbox --disable-dev-shm-usage\\"","workshop:pdf:a4":"reveal-md workshop/slides.md --print workshop/Visor-Workshop-A4.pdf --print-size A4","workshop:build":"npm run workshop:export && npm run workshop:pdf","simulate:issue":"TS_NODE_TRANSPILE_ONLY=1 ts-node scripts/simulate-gh-run.ts --event issues --action opened --debug","simulate:comment":"TS_NODE_TRANSPILE_ONLY=1 ts-node scripts/simulate-gh-run.ts --event issue_comment --action created --debug"},"keywords":["code-review","ai","github-action","cli","pr-review","visor"],"author":"Probe Labs","license":"MIT","description":"AI workflow engine for code review, assistants, and automation — orchestrate checks, MCP tools, and AI providers with YAML-driven pipelines","repository":{"type":"git","url":"git+https://github.com/probelabs/visor.git"},"bugs":{"url":"https://github.com/probelabs/visor/issues"},"homepage":"https://github.com/probelabs/visor#readme","dependencies":{"@actions/core":"^1.11.1","@apidevtools/swagger-parser":"^12.1.0","@modelcontextprotocol/sdk":"^1.25.3","@nyariv/sandboxjs":"github:probelabs/SandboxJS#f1c13b8eee98734a8ea024061eada4aa9a9ff2e9","@octokit/action":"^8.0.2","@octokit/auth-app":"^8.1.0","@octokit/core":"^7.0.3","@octokit/rest":"^22.0.0","@opentelemetry/api":"^1.9.0","@opentelemetry/core":"^1.30.1","@opentelemetry/exporter-trace-otlp-grpc":"^0.203.0","@opentelemetry/exporter-trace-otlp-http":"^0.203.0","@opentelemetry/instrumentation":"^0.203.0","@opentelemetry/resources":"^1.30.1","@opentelemetry/sdk-metrics":"^1.30.1","@opentelemetry/sdk-node":"^0.203.0","@opentelemetry/sdk-trace-base":"^1.30.1","@opentelemetry/semantic-conventions":"^1.30.1","@probelabs/probe":"^0.6.0-rc260","@types/commander":"^2.12.0","@types/uuid":"^10.0.0","acorn":"^8.16.0","acorn-walk":"^8.3.5","ajv":"^8.17.1","ajv-formats":"^3.0.1","better-sqlite3":"^11.0.0","blessed":"^0.1.81","cli-table3":"^0.6.5","commander":"^14.0.0","deepmerge":"^4.3.1","dotenv":"^17.2.3","ignore":"^7.0.5","js-yaml":"^4.1.0","jsonpath-plus":"^10.4.0","liquidjs":"^10.21.1","minimatch":"^10.2.2","node-cron":"^3.0.3","open":"^9.1.0","simple-git":"^3.28.0","uuid":"^11.1.0","ws":"^8.18.3"},"optionalDependencies":{"@anthropic/claude-code-sdk":"npm:null@*","@open-policy-agent/opa-wasm":"^1.10.0","knex":"^3.1.0","mysql2":"^3.11.0","pg":"^8.13.0","tedious":"^19.0.0"},"devDependencies":{"@eslint/js":"^9.34.0","@kie/act-js":"^2.6.2","@kie/mock-github":"^2.0.1","@swc/core":"^1.13.2","@swc/jest":"^0.2.37","@types/better-sqlite3":"^7.6.0","@types/blessed":"^0.1.27","@types/jest":"^30.0.0","@types/js-yaml":"^4.0.9","@types/node":"^24.3.0","@types/node-cron":"^3.0.11","@types/ws":"^8.18.1","@typescript-eslint/eslint-plugin":"^8.42.0","@typescript-eslint/parser":"^8.42.0","@vercel/ncc":"^0.38.4","eslint":"^9.34.0","eslint-config-prettier":"^10.1.8","eslint-plugin-prettier":"^5.5.4","husky":"^9.1.7","jest":"^30.1.3","lint-staged":"^16.1.6","prettier":"^3.6.2","reveal-md":"^6.1.2","ts-json-schema-generator":"^1.5.1","ts-node":"^10.9.2","tsup":"^8.5.0","typescript":"^5.9.2","wrangler":"^3.0.0"},"peerDependenciesMeta":{"@anthropic/claude-code-sdk":{"optional":true}},"directories":{"test":"tests"},"lint-staged":{"src/**/*.{ts,js}":["eslint --fix","prettier --write"],"tests/**/*.{ts,js}":["eslint --fix","prettier --write"],"*.{json,md,yml,yaml}":["prettier --write"]}}');
+module.exports = /*#__PURE__*/JSON.parse('{"name":"@probelabs/visor","version":"0.1.42","main":"dist/index.js","bin":{"visor":"./dist/index.js"},"exports":{".":{"require":"./dist/index.js","import":"./dist/index.js"},"./sdk":{"types":"./dist/sdk/sdk.d.ts","import":"./dist/sdk/sdk.mjs","require":"./dist/sdk/sdk.js"},"./cli":{"require":"./dist/index.js"}},"files":["dist/","defaults/","action.yml","README.md","LICENSE"],"publishConfig":{"access":"public","registry":"https://registry.npmjs.org/"},"scripts":{"build:cli":"ncc build src/index.ts -o dist && cp -r defaults dist/ && cp -r output dist/ && cp -r docs dist/ && cp -r examples dist/ && cp -r src/debug-visualizer/ui dist/debug-visualizer/ && node scripts/inject-version.js && echo \'#!/usr/bin/env node\' | cat - dist/index.js > temp && mv temp dist/index.js && chmod +x dist/index.js","build:sdk":"tsup src/sdk.ts --dts --sourcemap --format esm,cjs --out-dir dist/sdk","build":"./scripts/build-oss.sh","build:ee":"npm run build:cli && npm run build:sdk","test":"jest && npm run test:yaml","test:unit":"jest","prepublishOnly":"npm run build","test:watch":"jest --watch","test:coverage":"jest --coverage","test:ee":"jest --testPathPatterns=\'tests/ee\' --testPathIgnorePatterns=\'/node_modules/\' --no-coverage","test:manual:bash":"RUN_MANUAL_TESTS=true jest tests/manual/bash-config-manual.test.ts","lint":"eslint src tests --ext .ts","lint:fix":"eslint src tests --ext .ts --fix","format":"prettier --write src tests","format:check":"prettier --check src tests","clean":"","clean:traces":"node scripts/clean-traces.js","prebuild":"npm run clean && node scripts/generate-config-schema.js","pretest":"npm run clean:traces && node scripts/generate-config-schema.js && npm run build:cli","pretest:unit":"npm run clean:traces && node scripts/generate-config-schema.js && npm run build:cli","test:with-build":"npm run build:cli && jest","test:yaml":"node dist/index.js test --progress compact","test:yaml:parallel":"node dist/index.js test --progress compact --max-parallel 4","prepare":"husky","pre-commit":"lint-staged","deploy:site":"cd site && npx wrangler pages deploy . --project-name=visor-site --commit-dirty=true","deploy:worker":"npx wrangler deploy","deploy":"npm run deploy:site && npm run deploy:worker","publish:ee":"./scripts/publish-ee.sh","release":"./scripts/release.sh","release:patch":"./scripts/release.sh patch","release:minor":"./scripts/release.sh minor","release:major":"./scripts/release.sh major","release:prerelease":"./scripts/release.sh prerelease","docs:validate":"node scripts/validate-readme-links.js","workshop:setup":"npm install -D reveal-md@6.1.2","workshop:serve":"cd workshop && reveal-md slides.md -w","workshop:export":"reveal-md workshop/slides.md --static workshop/build","workshop:pdf":"reveal-md workshop/slides.md --print workshop/Visor-Workshop.pdf --print-size letter","workshop:pdf:ci":"reveal-md workshop/slides.md --print workshop/Visor-Workshop.pdf --print-size letter --puppeteer-launch-args=\\"--no-sandbox --disable-dev-shm-usage\\"","workshop:pdf:a4":"reveal-md workshop/slides.md --print workshop/Visor-Workshop-A4.pdf --print-size A4","workshop:build":"npm run workshop:export && npm run workshop:pdf","simulate:issue":"TS_NODE_TRANSPILE_ONLY=1 ts-node scripts/simulate-gh-run.ts --event issues --action opened --debug","simulate:comment":"TS_NODE_TRANSPILE_ONLY=1 ts-node scripts/simulate-gh-run.ts --event issue_comment --action created --debug"},"keywords":["code-review","ai","github-action","cli","pr-review","visor"],"author":"Probe Labs","license":"MIT","description":"AI workflow engine for code review, assistants, and automation — orchestrate checks, MCP tools, and AI providers with YAML-driven pipelines","repository":{"type":"git","url":"git+https://github.com/probelabs/visor.git"},"bugs":{"url":"https://github.com/probelabs/visor/issues"},"homepage":"https://github.com/probelabs/visor#readme","dependencies":{"@actions/core":"^1.11.1","@apidevtools/swagger-parser":"^12.1.0","@modelcontextprotocol/sdk":"^1.25.3","@nyariv/sandboxjs":"github:probelabs/SandboxJS#f1c13b8eee98734a8ea024061eada4aa9a9ff2e9","@octokit/action":"^8.0.2","@octokit/auth-app":"^8.1.0","@octokit/core":"^7.0.3","@octokit/rest":"^22.0.0","@opentelemetry/api":"^1.9.0","@opentelemetry/core":"^1.30.1","@opentelemetry/exporter-trace-otlp-grpc":"^0.203.0","@opentelemetry/exporter-trace-otlp-http":"^0.203.0","@opentelemetry/instrumentation":"^0.203.0","@opentelemetry/resources":"^1.30.1","@opentelemetry/sdk-metrics":"^1.30.1","@opentelemetry/sdk-node":"^0.203.0","@opentelemetry/sdk-trace-base":"^1.30.1","@opentelemetry/semantic-conventions":"^1.30.1","@probelabs/probe":"^0.6.0-rc262","@types/commander":"^2.12.0","@types/uuid":"^10.0.0","acorn":"^8.16.0","acorn-walk":"^8.3.5","ajv":"^8.17.1","ajv-formats":"^3.0.1","better-sqlite3":"^11.0.0","blessed":"^0.1.81","cli-table3":"^0.6.5","commander":"^14.0.0","deepmerge":"^4.3.1","dotenv":"^17.2.3","ignore":"^7.0.5","js-yaml":"^4.1.0","jsonpath-plus":"^10.4.0","liquidjs":"^10.21.1","minimatch":"^10.2.2","node-cron":"^3.0.3","open":"^9.1.0","simple-git":"^3.28.0","uuid":"^11.1.0","ws":"^8.18.3"},"optionalDependencies":{"@anthropic/claude-code-sdk":"npm:null@*","@open-policy-agent/opa-wasm":"^1.10.0","knex":"^3.1.0","mysql2":"^3.11.0","pg":"^8.13.0","tedious":"^19.0.0"},"devDependencies":{"@eslint/js":"^9.34.0","@kie/act-js":"^2.6.2","@kie/mock-github":"^2.0.1","@swc/core":"^1.13.2","@swc/jest":"^0.2.37","@types/better-sqlite3":"^7.6.0","@types/blessed":"^0.1.27","@types/jest":"^30.0.0","@types/js-yaml":"^4.0.9","@types/node":"^24.3.0","@types/node-cron":"^3.0.11","@types/ws":"^8.18.1","@typescript-eslint/eslint-plugin":"^8.42.0","@typescript-eslint/parser":"^8.42.0","@vercel/ncc":"^0.38.4","eslint":"^9.34.0","eslint-config-prettier":"^10.1.8","eslint-plugin-prettier":"^5.5.4","husky":"^9.1.7","jest":"^30.1.3","lint-staged":"^16.1.6","prettier":"^3.6.2","reveal-md":"^6.1.2","ts-json-schema-generator":"^1.5.1","ts-node":"^10.9.2","tsup":"^8.5.0","typescript":"^5.9.2","wrangler":"^3.0.0"},"peerDependenciesMeta":{"@anthropic/claude-code-sdk":{"optional":true}},"directories":{"test":"tests"},"lint-staged":{"src/**/*.{ts,js}":["eslint --fix","prettier --write"],"tests/**/*.{ts,js}":["eslint --fix","prettier --write"],"*.{json,md,yml,yaml}":["prettier --write"]}}');
 
 /***/ })